Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	June 9, 2023, 4:15 p.m.	June 9, 2023, 4:18 p.m.

Size	707.5KB
Type	Microsoft Excel 2007+
MD5	`261cc699f2de3e15d63c9a9180cb8625`
SHA256	`f08bfda687fb0ba2d1e4563a6a7d75958d5ef4a1b7ea61b51c96ddc08202e1ba`
CRC32	`998EE80B`
ssdeep	`12288:M/UZf3FotX6dmtGrDDkBB9UFG+ZFQsnRV4hSISDCQ2UYWCQ5BEpMYzKGyOq:MOF+zGoBB9StZ2wvZISDC4Yk0EOq`
Yara	zip_file_format - ZIP file format

EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" C:\Users\test22\AppData\Local\Temp\SOA-0438.xlsx
3056

Name	Response	Post-Analysis Lookup
geoplugin.net	A 178.237.33.50	178.237.33.50
gdyhjjdhbvxgsfe.gotdns.ch	A 45.81.39.214	45.81.39.214

IP Address	Status	Action
109.206.240.64	Active	Moloch
164.124.101.2	Active	Moloch
178.237.33.50	Active	Moloch
45.81.39.214	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49163 -> 109.206.240.64:80	2016141	ET INFO Executable Download from dotted-quad Host	Potentially Bad Traffic
TCP 192.168.56.102:49172 -> 109.206.240.64:80	2018752	ET MALWARE Generic .bin download from Dotted Quad	A Network Trojan was detected
UDP 192.168.56.102:63709 -> 164.124.101.2:53	2042740	ET INFO DYNAMIC_DNS Query to a *.gotdns .ch Domain	Potentially Bad Traffic
TCP 192.168.56.102:49173 -> 45.81.39.214:2718	2036594	ET JA3 Hash - Remcos 3.x TLS Connection	Malware Command and Control Activity Detected
TCP 109.206.240.64:80 -> 192.168.56.102:49163	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 109.206.240.64:80 -> 192.168.56.102:49163	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 109.206.240.64:80 -> 192.168.56.102:49163	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLS 1.3 192.168.56.102:49173 45.81.39.214:2718	None	None	None

One or more processes crashed (4 events)

Time & API	Arguments	Status
__exception__ June 9, 2023, 4:16 p.m.	stacktrace: RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x750b374b DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x75bbf725 NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x750c414b WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x75bbc8e2 CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x75ab98ad OleCreateEmbeddingHelper+0x2a1 CreateFileMoniker-0x17de ole32+0x81414 @ 0x75b01414 ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x75b17b68 MdCallBack-0x5f79a6 excel+0x3f6187 @ 0x30216187 MdCallBack-0x838622 excel+0x1b550b @ 0x2ffd550b MdCallBack-0x85136b excel+0x19c7c2 @ 0x2ffbc7c2 MdCallBack-0x8553c7 excel+0x198766 @ 0x2ffb8766 MdCallBack-0x2acb5b excel+0x740fd2 @ 0x30560fd2 MdCallBack-0x2aca0a excel+0x741123 @ 0x30561123 MdCallBack-0x672e1c excel+0x37ad11 @ 0x3019ad11 MdCallBack-0x9e5260 excel+0x88cd @ 0x2fe288cd MdCallBack-0x9e7589 excel+0x65a4 @ 0x2fe265a4 MdCallBack-0x9e9918 excel+0x4215 @ 0x2fe24215 MdCallBack-0x9e9c23 excel+0x3f0a @ 0x2fe23f0a BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x74e833ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x774a9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x774a9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0x800706be exception.offset: 46887 exception.address: 0x7588b727 registers.esp: 1335080 registers.edi: 1974270480 registers.eax: 1335080 registers.ebp: 1335160 registers.edx: 0 registers.ebx: 4063484 registers.esi: 2147944126 registers.ecx: 335432670	1
__exception__ June 9, 2023, 4:16 p.m.	stacktrace: RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x750b374b DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x75bbf725 NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x750c414b WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x75bbc8e2 CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x75ab98ad CoRegisterMessageFilter+0x5048 ObjectStublessClient5-0x21 ole32+0x3b641 @ 0x75abb641 CoRegisterMessageFilter+0x4ff4 ObjectStublessClient5-0x75 ole32+0x3b5ed @ 0x75abb5ed CoRegisterMessageFilter+0x4b79 ObjectStublessClient5-0x4f0 ole32+0x3b172 @ 0x75abb172 CoRegisterMessageFilter+0x4075 ObjectStublessClient5-0xff4 ole32+0x3a66e @ 0x75aba66e ObjectStublessClient31+0x2961c STGMEDIUM_UserUnmarshal-0x92 ole32+0xba68c @ 0x75b3a68c ObjectStublessClient31+0x6776 STGMEDIUM_UserUnmarshal-0x22f38 ole32+0x977e6 @ 0x75b177e6 OleCreateEmbeddingHelper+0x344 CreateFileMoniker-0x173b ole32+0x814b7 @ 0x75b014b7 ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x75b17b68 MdCallBack-0x5f79a6 excel+0x3f6187 @ 0x30216187 MdCallBack-0x838622 excel+0x1b550b @ 0x2ffd550b MdCallBack-0x85136b excel+0x19c7c2 @ 0x2ffbc7c2 MdCallBack-0x8553c7 excel+0x198766 @ 0x2ffb8766 MdCallBack-0x2acb5b excel+0x740fd2 @ 0x30560fd2 MdCallBack-0x2aca0a excel+0x741123 @ 0x30561123 MdCallBack-0x672e1c excel+0x37ad11 @ 0x3019ad11 MdCallBack-0x9e5260 excel+0x88cd @ 0x2fe288cd MdCallBack-0x9e7589 excel+0x65a4 @ 0x2fe265a4 MdCallBack-0x9e9918 excel+0x4215 @ 0x2fe24215 MdCallBack-0x9e9c23 excel+0x3f0a @ 0x2fe23f0a BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x74e833ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x774a9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x774a9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0x800706ba exception.offset: 46887 exception.address: 0x7588b727 registers.esp: 1334772 registers.edi: 1974270480 registers.eax: 1334772 registers.ebp: 1334852 registers.edx: 0 registers.ebx: 4062980 registers.esi: 2147944122 registers.ecx: 335432670	1
__exception__ June 9, 2023, 4:16 p.m.	stacktrace: RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x750b374b NdrAllocate+0x5c8 RpcBindingFromStringBindingA-0xca4 rpcrt4+0x42b08 @ 0x750d2b08 NdrGetBuffer+0xf4 NdrSendReceive-0x6 rpcrt4+0x1801a @ 0x750a801a SLClose-0x28e osppc+0x33cf @ 0x747233cf SLLoadApplicationPolicies+0xa99 SLCallServer-0x330 osppc+0x15dba @ 0x74735dba SLClose+0x4c4 SLpBeginGenuineTicketTransaction-0x4f79 osppc+0x3b21 @ 0x74723b21 SLpVLActivateProduct+0xcb SLpGetMSPidInformation-0x111 osppc+0x12074 @ 0x74732074 SLActivateProduct+0x48e SLInitialize-0x110a osppcext+0x385c7 @ 0x676785c7 ??0OdfStgParams@@QAE@XZ+0xbae22 mso+0xfbdd28 @ 0x71c0dd28 DllGetLCID+0x5c042 _MsoWebServerSupportEx@12-0x1c8a2b mso+0x6bc415 @ 0x7130c415 _MsoFGetTooltips@0+0x8918 _MsoHrSimpleQueryInterface@16-0x1221a mso+0xc90c4 @ 0x70d190c4 _MsoFGetTooltips@0+0x88ca _MsoHrSimpleQueryInterface@16-0x12268 mso+0xc9076 @ 0x70d19076 _MsoPeekMessage@8+0x49a0 _MsoGetStringTypeExW@20-0x1697 mso+0xb724d @ 0x70d0724d _MsoCpgFromChs@4+0x14e3 _MsoCrCbvGet@4-0xa6c mso+0x30f14 @ 0x70c80f14 _MsoGetHmodPTLServices@0+0x4883 _MsoCpgFromChs@4-0x1e10 mso+0x2dc21 @ 0x70c7dc21 _MsoGetHmodPTLServices@0+0x45f3 _MsoCpgFromChs@4-0x20a0 mso+0x2d991 @ 0x70c7d991 _MsoGetHmodPTLServices@0+0x326f _MsoCpgFromChs@4-0x3424 mso+0x2c60d @ 0x70c7c60d _MsoFCreateIPref@28+0x143f _MsoFUseIEFeature@8-0xee0 mso+0x22ce6 @ 0x70c72ce6 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x74e833ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x774a9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x774a9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0x8007007b exception.offset: 46887 exception.address: 0x7588b727 registers.esp: 72938292 registers.edi: 72938456 registers.eax: 72938292 registers.ebp: 72938372 registers.edx: 0 registers.ebx: 72939508 registers.esi: 2147942523 registers.ecx: 2147483648	1
__exception__ June 9, 2023, 4:16 p.m.	stacktrace: RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x750b374b NdrAllocate+0x5c8 RpcBindingFromStringBindingA-0xca4 rpcrt4+0x42b08 @ 0x750d2b08 NdrGetBuffer+0xf4 NdrSendReceive-0x6 rpcrt4+0x1801a @ 0x750a801a SLClose-0x28e osppc+0x33cf @ 0x747233cf SLLoadApplicationPolicies+0xa99 SLCallServer-0x330 osppc+0x15dba @ 0x74735dba SLClose+0x4c4 SLpBeginGenuineTicketTransaction-0x4f79 osppc+0x3b21 @ 0x74723b21 SLpGetTokenActivationGrantInfo+0x13c SLpGenerateTokenActivationChallenge-0x11c osppc+0x13102 @ 0x74733102 SLGetTokenActivationGrants+0x710 SLGetTokenActivationCertificates-0x7a8 osppcext+0x5f7d0 @ 0x6769f7d0 ??0OdfStgParams@@QAE@XZ+0xbb1e7 mso+0xfbe0ed @ 0x71c0e0ed ??0OdfStgParams@@QAE@XZ+0xbb3c9 mso+0xfbe2cf @ 0x71c0e2cf DllGetClassObject+0x3c2bb _MsoFActivateControl@4-0x25231 mso+0xa84871 @ 0x716d4871 DllGetClassObject+0x3c339 _MsoFActivateControl@4-0x251b3 mso+0xa848ef @ 0x716d48ef _MsoFHideTaiwan@0+0x4ccf _MsoSetLVProperty@8-0x7e2a9 mso+0x274ea0 @ 0x70ec4ea0 _MsoFDoSmartTagSecurityCheck@8+0xb6367 _MsoCompareStringA@24-0x391 mso+0x61d7ab @ 0x7126d7ab ??0OdfStgParams@@QAE@XZ+0xed5ed mso+0xff04f3 @ 0x71c404f3 DllGetLCID+0x5c144 _MsoWebServerSupportEx@12-0x1c8929 mso+0x6bc517 @ 0x7130c517 _MsoFGetTooltips@0+0x8918 _MsoHrSimpleQueryInterface@16-0x1221a mso+0xc90c4 @ 0x70d190c4 _MsoFGetTooltips@0+0x8844 _MsoHrSimpleQueryInterface@16-0x122ee mso+0xc8ff0 @ 0x70d18ff0 _MsoPeekMessage@8+0x49e5 _MsoGetStringTypeExW@20-0x1652 mso+0xb7292 @ 0x70d07292 _MsoPeekMessage@8+0x49a0 _MsoGetStringTypeExW@20-0x1697 mso+0xb724d @ 0x70d0724d _MsoCpgFromChs@4+0x14e3 _MsoCrCbvGet@4-0xa6c mso+0x30f14 @ 0x70c80f14 _MsoGetHmodPTLServices@0+0x4883 _MsoCpgFromChs@4-0x1e10 mso+0x2dc21 @ 0x70c7dc21 _MsoGetHmodPTLServices@0+0x45f3 _MsoCpgFromChs@4-0x20a0 mso+0x2d991 @ 0x70c7d991 _MsoPeekMessage@8+0x4537 _MsoGetStringTypeExW@20-0x1b00 mso+0xb6de4 @ 0x70d06de4 _MsoPeekMessage@8+0x446e _MsoGetStringTypeExW@20-0x1bc9 mso+0xb6d1b @ 0x70d06d1b _MsoPeekMessage@8+0x16ad _MsoGetStringTypeExW@20-0x498a mso+0xb3f5a @ 0x70d03f5a _MsoPeekMessage@8+0x2294 _MsoGetStringTypeExW@20-0x3da3 mso+0xb4b41 @ 0x70d04b41 _MsoPeekMessage@8+0x1196 _MsoGetStringTypeExW@20-0x4ea1 mso+0xb3a43 @ 0x70d03a43 MdCallBack-0x9c7613 excel+0x2651a @ 0x2fe4651a MdCallBack-0x9c9bd0 excel+0x23f5d @ 0x2fe43f5d MdCallBack-0x9e98e2 excel+0x424b @ 0x2fe2424b MdCallBack-0x9e9c23 excel+0x3f0a @ 0x2fe23f0a BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x74e833ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x774a9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x774a9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc004f011 exception.offset: 46887 exception.address: 0x7588b727 registers.esp: 1369464 registers.edi: 1369628 registers.eax: 1369464 registers.ebp: 1369544 registers.edx: 0 registers.ebx: 1370680 registers.esi: 3221549073 registers.ecx: 2147483648	1

HTTP traffic contains suspicious features which may be indicative of malware related traffic (3 events)

suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://109.206.240.64/HBZ.exe
suspicious_features	Connection to IP address	suspicious_request	GET http://109.206.240.64/tl/ZriAIHCKuK34.bin
suspicious_features	GET method with no useragent header	suspicious_request	GET http://geoplugin.net/json.gp

Performs some HTTP requests (3 events)

request	GET http://109.206.240.64/HBZ.exe
request	GET http://109.206.240.64/tl/ZriAIHCKuK34.bin
request	GET http://geoplugin.net/json.gp

Allocates read-write-execute memory (usually to unpack itself) (3 events)

Time & API	Arguments	Status
NtProtectVirtualMemory June 9, 2023, 4:16 p.m.	process_identifier: 3056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6b6d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 9, 2023, 4:16 p.m.	process_identifier: 3056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x67843000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 9, 2023, 4:16 p.m.	process_identifier: 3056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6b792000 process_handle: 0xffffffff	1

An application raised an exception which may be indicative of an exploit crash (5 events)

Time & API	Arguments	Status	Return	Repeated
Application Crash	Process EXCEL.EXE with pid 3056 crashed
__exception__ June 9, 2023, 4:16 p.m.	stacktrace: RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x750b374b DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x75bbf725 NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x750c414b WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x75bbc8e2 CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x75ab98ad OleCreateEmbeddingHelper+0x2a1 CreateFileMoniker-0x17de ole32+0x81414 @ 0x75b01414 ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x75b17b68 MdCallBack-0x5f79a6 excel+0x3f6187 @ 0x30216187 MdCallBack-0x838622 excel+0x1b550b @ 0x2ffd550b MdCallBack-0x85136b excel+0x19c7c2 @ 0x2ffbc7c2 MdCallBack-0x8553c7 excel+0x198766 @ 0x2ffb8766 MdCallBack-0x2acb5b excel+0x740fd2 @ 0x30560fd2 MdCallBack-0x2aca0a excel+0x741123 @ 0x30561123 MdCallBack-0x672e1c excel+0x37ad11 @ 0x3019ad11 MdCallBack-0x9e5260 excel+0x88cd @ 0x2fe288cd MdCallBack-0x9e7589 excel+0x65a4 @ 0x2fe265a4 MdCallBack-0x9e9918 excel+0x4215 @ 0x2fe24215 MdCallBack-0x9e9c23 excel+0x3f0a @ 0x2fe23f0a BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x74e833ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x774a9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x774a9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0x800706be exception.offset: 46887 exception.address: 0x7588b727 registers.esp: 1335080 registers.edi: 1974270480 registers.eax: 1335080 registers.ebp: 1335160 registers.edx: 0 registers.ebx: 4063484 registers.esi: 2147944126 registers.ecx: 335432670	1	0	0
__exception__ June 9, 2023, 4:16 p.m.	stacktrace: RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x750b374b DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x75bbf725 NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x750c414b WdtpInterfacePointer_UserUnmarshal+0x166b DllDebugObjectRPCHook-0x2d8d ole32+0x13c8e2 @ 0x75bbc8e2 CoRegisterMessageFilter+0x32b4 ObjectStublessClient5-0x1db5 ole32+0x398ad @ 0x75ab98ad CoRegisterMessageFilter+0x5048 ObjectStublessClient5-0x21 ole32+0x3b641 @ 0x75abb641 CoRegisterMessageFilter+0x4ff4 ObjectStublessClient5-0x75 ole32+0x3b5ed @ 0x75abb5ed CoRegisterMessageFilter+0x4b79 ObjectStublessClient5-0x4f0 ole32+0x3b172 @ 0x75abb172 CoRegisterMessageFilter+0x4075 ObjectStublessClient5-0xff4 ole32+0x3a66e @ 0x75aba66e ObjectStublessClient31+0x2961c STGMEDIUM_UserUnmarshal-0x92 ole32+0xba68c @ 0x75b3a68c ObjectStublessClient31+0x6776 STGMEDIUM_UserUnmarshal-0x22f38 ole32+0x977e6 @ 0x75b177e6 OleCreateEmbeddingHelper+0x344 CreateFileMoniker-0x173b ole32+0x814b7 @ 0x75b014b7 ObjectStublessClient31+0x6af8 STGMEDIUM_UserUnmarshal-0x22bb6 ole32+0x97b68 @ 0x75b17b68 MdCallBack-0x5f79a6 excel+0x3f6187 @ 0x30216187 MdCallBack-0x838622 excel+0x1b550b @ 0x2ffd550b MdCallBack-0x85136b excel+0x19c7c2 @ 0x2ffbc7c2 MdCallBack-0x8553c7 excel+0x198766 @ 0x2ffb8766 MdCallBack-0x2acb5b excel+0x740fd2 @ 0x30560fd2 MdCallBack-0x2aca0a excel+0x741123 @ 0x30561123 MdCallBack-0x672e1c excel+0x37ad11 @ 0x3019ad11 MdCallBack-0x9e5260 excel+0x88cd @ 0x2fe288cd MdCallBack-0x9e7589 excel+0x65a4 @ 0x2fe265a4 MdCallBack-0x9e9918 excel+0x4215 @ 0x2fe24215 MdCallBack-0x9e9c23 excel+0x3f0a @ 0x2fe23f0a BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x74e833ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x774a9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x774a9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0x800706ba exception.offset: 46887 exception.address: 0x7588b727 registers.esp: 1334772 registers.edi: 1974270480 registers.eax: 1334772 registers.ebp: 1334852 registers.edx: 0 registers.ebx: 4062980 registers.esi: 2147944122 registers.ecx: 335432670	1	0	0
__exception__ June 9, 2023, 4:16 p.m.	stacktrace: RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x750b374b NdrAllocate+0x5c8 RpcBindingFromStringBindingA-0xca4 rpcrt4+0x42b08 @ 0x750d2b08 NdrGetBuffer+0xf4 NdrSendReceive-0x6 rpcrt4+0x1801a @ 0x750a801a SLClose-0x28e osppc+0x33cf @ 0x747233cf SLLoadApplicationPolicies+0xa99 SLCallServer-0x330 osppc+0x15dba @ 0x74735dba SLClose+0x4c4 SLpBeginGenuineTicketTransaction-0x4f79 osppc+0x3b21 @ 0x74723b21 SLpVLActivateProduct+0xcb SLpGetMSPidInformation-0x111 osppc+0x12074 @ 0x74732074 SLActivateProduct+0x48e SLInitialize-0x110a osppcext+0x385c7 @ 0x676785c7 ??0OdfStgParams@@QAE@XZ+0xbae22 mso+0xfbdd28 @ 0x71c0dd28 DllGetLCID+0x5c042 _MsoWebServerSupportEx@12-0x1c8a2b mso+0x6bc415 @ 0x7130c415 _MsoFGetTooltips@0+0x8918 _MsoHrSimpleQueryInterface@16-0x1221a mso+0xc90c4 @ 0x70d190c4 _MsoFGetTooltips@0+0x88ca _MsoHrSimpleQueryInterface@16-0x12268 mso+0xc9076 @ 0x70d19076 _MsoPeekMessage@8+0x49a0 _MsoGetStringTypeExW@20-0x1697 mso+0xb724d @ 0x70d0724d _MsoCpgFromChs@4+0x14e3 _MsoCrCbvGet@4-0xa6c mso+0x30f14 @ 0x70c80f14 _MsoGetHmodPTLServices@0+0x4883 _MsoCpgFromChs@4-0x1e10 mso+0x2dc21 @ 0x70c7dc21 _MsoGetHmodPTLServices@0+0x45f3 _MsoCpgFromChs@4-0x20a0 mso+0x2d991 @ 0x70c7d991 _MsoGetHmodPTLServices@0+0x326f _MsoCpgFromChs@4-0x3424 mso+0x2c60d @ 0x70c7c60d _MsoFCreateIPref@28+0x143f _MsoFUseIEFeature@8-0xee0 mso+0x22ce6 @ 0x70c72ce6 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x74e833ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x774a9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x774a9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0x8007007b exception.offset: 46887 exception.address: 0x7588b727 registers.esp: 72938292 registers.edi: 72938456 registers.eax: 72938292 registers.ebp: 72938372 registers.edx: 0 registers.ebx: 72939508 registers.esi: 2147942523 registers.ecx: 2147483648	1	0	0
__exception__ June 9, 2023, 4:16 p.m.	stacktrace: RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x750b374b NdrAllocate+0x5c8 RpcBindingFromStringBindingA-0xca4 rpcrt4+0x42b08 @ 0x750d2b08 NdrGetBuffer+0xf4 NdrSendReceive-0x6 rpcrt4+0x1801a @ 0x750a801a SLClose-0x28e osppc+0x33cf @ 0x747233cf SLLoadApplicationPolicies+0xa99 SLCallServer-0x330 osppc+0x15dba @ 0x74735dba SLClose+0x4c4 SLpBeginGenuineTicketTransaction-0x4f79 osppc+0x3b21 @ 0x74723b21 SLpGetTokenActivationGrantInfo+0x13c SLpGenerateTokenActivationChallenge-0x11c osppc+0x13102 @ 0x74733102 SLGetTokenActivationGrants+0x710 SLGetTokenActivationCertificates-0x7a8 osppcext+0x5f7d0 @ 0x6769f7d0 ??0OdfStgParams@@QAE@XZ+0xbb1e7 mso+0xfbe0ed @ 0x71c0e0ed ??0OdfStgParams@@QAE@XZ+0xbb3c9 mso+0xfbe2cf @ 0x71c0e2cf DllGetClassObject+0x3c2bb _MsoFActivateControl@4-0x25231 mso+0xa84871 @ 0x716d4871 DllGetClassObject+0x3c339 _MsoFActivateControl@4-0x251b3 mso+0xa848ef @ 0x716d48ef _MsoFHideTaiwan@0+0x4ccf _MsoSetLVProperty@8-0x7e2a9 mso+0x274ea0 @ 0x70ec4ea0 _MsoFDoSmartTagSecurityCheck@8+0xb6367 _MsoCompareStringA@24-0x391 mso+0x61d7ab @ 0x7126d7ab ??0OdfStgParams@@QAE@XZ+0xed5ed mso+0xff04f3 @ 0x71c404f3 DllGetLCID+0x5c144 _MsoWebServerSupportEx@12-0x1c8929 mso+0x6bc517 @ 0x7130c517 _MsoFGetTooltips@0+0x8918 _MsoHrSimpleQueryInterface@16-0x1221a mso+0xc90c4 @ 0x70d190c4 _MsoFGetTooltips@0+0x8844 _MsoHrSimpleQueryInterface@16-0x122ee mso+0xc8ff0 @ 0x70d18ff0 _MsoPeekMessage@8+0x49e5 _MsoGetStringTypeExW@20-0x1652 mso+0xb7292 @ 0x70d07292 _MsoPeekMessage@8+0x49a0 _MsoGetStringTypeExW@20-0x1697 mso+0xb724d @ 0x70d0724d _MsoCpgFromChs@4+0x14e3 _MsoCrCbvGet@4-0xa6c mso+0x30f14 @ 0x70c80f14 _MsoGetHmodPTLServices@0+0x4883 _MsoCpgFromChs@4-0x1e10 mso+0x2dc21 @ 0x70c7dc21 _MsoGetHmodPTLServices@0+0x45f3 _MsoCpgFromChs@4-0x20a0 mso+0x2d991 @ 0x70c7d991 _MsoPeekMessage@8+0x4537 _MsoGetStringTypeExW@20-0x1b00 mso+0xb6de4 @ 0x70d06de4 _MsoPeekMessage@8+0x446e _MsoGetStringTypeExW@20-0x1bc9 mso+0xb6d1b @ 0x70d06d1b _MsoPeekMessage@8+0x16ad _MsoGetStringTypeExW@20-0x498a mso+0xb3f5a @ 0x70d03f5a _MsoPeekMessage@8+0x2294 _MsoGetStringTypeExW@20-0x3da3 mso+0xb4b41 @ 0x70d04b41 _MsoPeekMessage@8+0x1196 _MsoGetStringTypeExW@20-0x4ea1 mso+0xb3a43 @ 0x70d03a43 MdCallBack-0x9c7613 excel+0x2651a @ 0x2fe4651a MdCallBack-0x9c9bd0 excel+0x23f5d @ 0x2fe43f5d MdCallBack-0x9e98e2 excel+0x424b @ 0x2fe2424b MdCallBack-0x9e9c23 excel+0x3f0a @ 0x2fe23f0a BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x74e833ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x774a9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x774a9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc004f011 exception.offset: 46887 exception.address: 0x7588b727 registers.esp: 1369464 registers.edi: 1369628 registers.eax: 1369464 registers.ebp: 1369544 registers.edx: 0 registers.ebx: 1370680 registers.esi: 3221549073 registers.ecx: 2147483648	1	0	0

Creates (office) documents on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\~$SOA-0438.xlsx

Creates hidden or system file (1 event)

Time & API	Arguments	Status	Return	Repeated
NtCreateFile June 9, 2023, 4:16 p.m.	create_disposition: 2 (FILE_CREATE) file_handle: 0x000003f0 filepath: C:\Users\test22\AppData\Local\Temp\~$SOA-0438.xlsx desired_access: 0xc0110080 (FILE_READ_ATTRIBUTES\|DELETE\|SYNCHRONIZE\|GENERIC_WRITE) file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$SOA-0438.xlsx create_options: 4198496 (FILE_NON_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT\|FILE_DELETE_ON_CLOSE) status_info: 2 (FILE_CREATED) share_access: 1 (FILE_SHARE_READ)	1	0	0

Communicates with host for which no DNS query was performed (1 event)

host

109.206.240.64

File has been identified by 37 AntiVirus engines on VirusTotal as malicious (37 events)

Lionic	Trojan.MSExcel.Generic.4!c
DrWeb	W97M.DownLoader.2938
FireEye	Exploit.MathType-Obfs.Gen
Sangfor	Exploit.Doc.CVE-2017-11882.b
Alibaba	Exploit:Office97/CVE-2017-11882.4c6e177b
Arcabit	Exploit.MathType-Obfs.Gen
VirIT	W97M.Downloader.CEH
Cyren	CVE-2017-11882.C.gen!Camelot
Symantec	Exp.CVE-2017-11882!g3
ESET-NOD32	probably a variant of Win32/Exploit.CVE-2017-11882.C
TrendMicro-HouseCall	TROJ_CVE20171182.SM
Avast	OLE:CVE-2017-11882-B [Expl]
Cynet	Malicious (score: 99)
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	Exploit.MathType-Obfs.Gen
Tencent	Exp.Ole.CVE-2017-11882.a
TACHYON	Suspicious/XOX.CVE-2017-11882
Emsisoft	Exploit.MathType-Obfs.Gen (B)
F-Secure	Exploit.EXP/CVE-2017-11882.Gen
VIPRE	Exploit.MathType-Obfs.Gen
TrendMicro	TROJ_CVE20171182.SM
McAfee-GW-Edition	Exploit-GBT!B950B053314E
Sophos	Exp/20180802-B
GData	Exploit.MathType-Obfs.Gen
Avira	EXP/CVE-2017-11882.Gen
Antiy-AVL	Trojan[Exploit]/Win32.CVE-2017-11882
Microsoft	Exploit:O97M/CVE-2017-11882!KZH
ZoneAlarm	HEUR:Exploit.MSOffice.Generic
Google	Detected
AhnLab-V3	OLE/Cve-2017-11882.Gen
McAfee	Exploit-GBT!B950B053314E
MAX	malware (ai score=88)
Zoner	Probably Heur.W97ShellO
Yandex	Trojan.AvsMofer.bYFDMn
Ikarus	Exploit.CVE-2017-11882
Fortinet	MSExcel/GenericKD.39744597!tr
AVG	OLE:CVE-2017-11882-B [Expl]

SOA-0438.xlsx

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All