popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Demo.dotx

Word 2007 file format(docx) ZIP Format
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Oct. 2, 2023, 2:24 p.m. Oct. 2, 2023, 2:27 p.m.
Size 12.6KB
Type Microsoft Word 2007+
MD5 1584bacd2e30ac9f584eb9cf8f843312
SHA256 dbb76f0c54100889190b0fef84c803b27bf604dd0b363921a64b82ef39fc6102
CRC32 9B4206BD
ssdeep 192:sztObzj89/6uyMtWNY6cDoWBmF0mqQTnhr5OG5VP0bFTB8GoA6a1n4N:itOkJyMti3cDoWBmXLONdR4N
Yara
  • zip_file_format - ZIP file format
  • docx - Word 2007 file format detection

Name Response Post-Analysis Lookup
redr.me
A 104.21.30.250
A 172.67.174.59
104.21.30.250
IP Address Status Action
164.124.101.2 Active Moloch
172.67.174.59 Active Moloch
192.3.108.47 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49165 -> 172.67.174.59:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49163 -> 172.67.174.59:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49166 -> 192.3.108.47:80 2022520 ET POLICY Possible HTA Application Download Potentially Bad Traffic
TCP 192.168.56.103:49166 -> 192.3.108.47:80 2027261 ET INFO Dotted Quad Host HTA Request Potentially Bad Traffic
TCP 192.168.56.103:49166 -> 192.3.108.47:80 2024449 ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl Attempted User Privilege Gain
TCP 192.3.108.47:80 -> 192.168.56.103:49166 2024197 ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199) A Network Trojan was detected
TCP 192.168.56.103:49166 -> 192.3.108.47:80 2027261 ET INFO Dotted Quad Host HTA Request Potentially Bad Traffic
TCP 192.168.56.103:49166 -> 192.3.108.47:80 2024224 ET WEB_CLIENT Office Requesting .HTA File Likely CVE-2017-0199 Request A Network Trojan was detected
TCP 192.168.56.103:49166 -> 192.3.108.47:80 2041131 ET USER_AGENTS Microsoft Office Existence Discovery User-Agent Misc activity
TCP 192.3.108.47:80 -> 192.168.56.103:49166 2024197 ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199) A Network Trojan was detected
TCP 192.3.108.47:80 -> 192.168.56.103:49166 2024226 ET WEB_CLIENT Office Discovery HTA file Likely CVE-2017-0199 Request M2 A Network Trojan was detected
TCP 192.168.56.103:49166 -> 192.3.108.47:80 2022520 ET POLICY Possible HTA Application Download Potentially Bad Traffic
TCP 192.168.56.103:49166 -> 192.3.108.47:80 2027261 ET INFO Dotted Quad Host HTA Request Potentially Bad Traffic
TCP 192.168.56.103:49166 -> 192.3.108.47:80 2024449 ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl Attempted User Privilege Gain
TCP 192.168.56.103:49166 -> 192.3.108.47:80 2027261 ET INFO Dotted Quad Host HTA Request Potentially Bad Traffic
TCP 192.168.56.103:49166 -> 192.3.108.47:80 2024224 ET WEB_CLIENT Office Requesting .HTA File Likely CVE-2017-0199 Request A Network Trojan was detected
TCP 192.3.108.47:80 -> 192.168.56.103:49166 2024197 ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199) A Network Trojan was detected
TCP 192.3.108.47:80 -> 192.168.56.103:49166 2024226 ET WEB_CLIENT Office Discovery HTA file Likely CVE-2017-0199 Request M2 A Network Trojan was detected
TCP 192.168.56.103:49166 -> 192.3.108.47:80 2022520 ET POLICY Possible HTA Application Download Potentially Bad Traffic
TCP 192.168.56.103:49166 -> 192.3.108.47:80 2027261 ET INFO Dotted Quad Host HTA Request Potentially Bad Traffic
TCP 192.168.56.103:49166 -> 192.3.108.47:80 2024449 ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl Attempted User Privilege Gain

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.103:49165
172.67.174.59:443 		C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 CN=redr.me 79:b5:6c:ad:de:52:0d:3f:6a:18:7f:62:1e:2b:4b:34:0d:ec:65:50
TLSv1
192.168.56.103:49163
172.67.174.59:443 		C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 CN=redr.me 79:b5:6c:ad:de:52:0d:3f:6a:18:7f:62:1e:2b:4b:34:0d:ec:65:50

Time & API Arguments Status Return Repeated

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\15.0\Registration\{91150000-0011-0000-0000-0000000FF1CE}\DigitalProductID
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x754c374b
NdrAllocate+0x5c8 RpcBindingFromStringBindingA-0xca4 rpcrt4+0x42b08 @ 0x754e2b08
NdrGetBuffer+0xf4 NdrSendReceive-0x6 rpcrt4+0x1801a @ 0x754b801a
SLClose-0x28c osppc+0x2cb5 @ 0x6b252cb5
SLLoadApplicationPolicies+0xb30 SLCallServer-0x31f osppc+0x15629 @ 0x6b265629
SLClose+0x4d1 SLpBeginGenuineTicketTransaction-0x4703 osppc+0x3412 @ 0x6b253412
SLpGetTokenActivationGrantInfo+0xd8 SLpGenerateTokenActivationChallenge-0xad osppc+0x129af @ 0x6b2629af
SLGetTokenActivationGrants+0x721 SLGetTokenActivationCertificates-0x7e7 osppcext+0x5a648 @ 0x688ea648
_MsoWzFromIhtk@4+0x73207 mso+0x1404a94 @ 0x70f24a94
_MsoWzFromIhtk@4+0x72f96 mso+0x1404823 @ 0x70f24823
_MsoDwGimmeUserInstallBehavior@8+0x1ad15 _MsoHrShowMetSharedNotebooksDlg@20-0x7a9d0 mso+0xcc30d3 @ 0x707e30d3
_MsoDwGimmeUserInstallBehavior@8+0x1aa61 _MsoHrShowMetSharedNotebooksDlg@20-0x7ac84 mso+0xcc2e1f @ 0x707e2e1f
_MsoFreeCvsList@4+0x261dac _MsoPwlfFromFlinfo@8-0x3674 mso+0x4e2b05 @ 0x70002b05
_MsoFreeCvsList@4+0x2616fd _MsoPwlfFromFlinfo@8-0x3d23 mso+0x4e2456 @ 0x70002456
0x590202
_MsoDwGimmeUserInstallBehavior@8+0x1798b _MsoHrShowMetSharedNotebooksDlg@20-0x7dd5a mso+0xcbfd49 @ 0x707dfd49
_MsoHrSetupHTMLImport@8+0x27d9 _MsoHrOscServicesManagerSharepointURL@8-0x9611 mso+0x2008cc @ 0x6fd208cc
_MsoFIEPolicyAndVersion@8+0x37cd _MsoTelemetryOnEndVBAMacroCallback@0-0x3f32 mso+0x1efa61 @ 0x6fd0fa61
_MsoFIEPolicyAndVersion@8+0x3574 _MsoTelemetryOnEndVBAMacroCallback@0-0x418b mso+0x1ef808 @ 0x6fd0f808
_MsoFIEPolicyAndVersion@8+0x3534 _MsoTelemetryOnEndVBAMacroCallback@0-0x41cb mso+0x1ef7c8 @ 0x6fd0f7c8
_MsoFEnsureMsoTypelib@0+0x2a5 _MsoInitShrGlobal@4-0x1bdf mso+0x23b6d @ 0x6fb43b6d
_MsoExtTextOutW@32+0x85f _MsoFWndProcNeeded@4-0x4a1 mso+0x222ad @ 0x6fb422ad
_MsoFGetTbShowKbdShortcuts@0+0x8b11 _MsoFDigitCh@4-0xbf35 mso+0x1b522d @ 0x6fcd522d
_MsoFGetTbShowKbdShortcuts@0+0x8a6d _MsoFDigitCh@4-0xbfd9 mso+0x1b5189 @ 0x6fcd5189
_MsoFGetTbShowKbdShortcuts@0+0x795f _MsoFDigitCh@4-0xd0e7 mso+0x1b407b @ 0x6fcd407b
_MsoFGetTbShowKbdShortcuts@0+0x788d _MsoFDigitCh@4-0xd1b9 mso+0x1b3fa9 @ 0x6fcd3fa9
_MsoFGetTbShowKbdShortcuts@0+0x784f _MsoFDigitCh@4-0xd1f7 mso+0x1b3f6b @ 0x6fcd3f6b
DllGetClassObject+0x6de67 DllGetLCID-0x1df82c wwlib+0x72aca @ 0x72162aca
DllGetClassObject+0x6de29 DllGetLCID-0x1df86a wwlib+0x72a8c @ 0x72162a8c
DllGetClassObject+0x864b4 DllGetLCID-0x1c71df wwlib+0x8b117 @ 0x7217b117
DllGetClassObject+0x66a5f DllGetLCID-0x1e6c34 wwlib+0x6b6c2 @ 0x7215b6c2
DllGetClassObject+0x63c72 DllGetLCID-0x1e9a21 wwlib+0x688d5 @ 0x721588d5
wdCommandDispatch-0x370 winword+0x15c4 @ 0xef15c4
wdCommandDispatch-0x3dc winword+0x1558 @ 0xef1558
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xc004f011
exception.offset: 46887
exception.address: 0x7559b727
registers.esp: 3854680
registers.edi: 3854844
registers.eax: 3854680
registers.ebp: 3854760
registers.edx: 0
registers.ebx: 3855896
registers.esi: 3221549073
registers.ecx: 2147483648
1 0 0
suspicious_features Connection to IP address suspicious_request GET http://192.3.108.47/demo/1/HTML.hta
suspicious_features Connection to IP address suspicious_request HEAD http://192.3.108.47/demo/1/HTML.hta
request GET http://192.3.108.47/demo/1/HTML.hta
request HEAD http://192.3.108.47/demo/1/HTML.hta
request OPTIONS https://redr.me/
request HEAD https://redr.me/llj4ev
request GET https://redr.me/llj4ev
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 652
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6a536000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 652
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6a434000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 652
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6a3f1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 652
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6a362000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 652
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x69ff1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2240
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00f51000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2240
region_size: 40960
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003e0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2240
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6feaf000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2240
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x35600000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2240
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75600000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2240
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 65536
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x35600000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2240
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x755f9000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2240
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 65536
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x35600000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2240
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75601000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2240
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75607000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2240
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6b2c4000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2240
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73c1a000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2240
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6a536000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2240
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6a362000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2240
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x697c1000
process_handle: 0xffffffff
1 0 0
Application Crash Process WINWORD.EXE with pid 652 crashed
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x754c374b
NdrAllocate+0x5c8 RpcBindingFromStringBindingA-0xca4 rpcrt4+0x42b08 @ 0x754e2b08
NdrGetBuffer+0xf4 NdrSendReceive-0x6 rpcrt4+0x1801a @ 0x754b801a
SLClose-0x28c osppc+0x2cb5 @ 0x6b252cb5
SLLoadApplicationPolicies+0xb30 SLCallServer-0x31f osppc+0x15629 @ 0x6b265629
SLClose+0x4d1 SLpBeginGenuineTicketTransaction-0x4703 osppc+0x3412 @ 0x6b253412
SLpGetTokenActivationGrantInfo+0xd8 SLpGenerateTokenActivationChallenge-0xad osppc+0x129af @ 0x6b2629af
SLGetTokenActivationGrants+0x721 SLGetTokenActivationCertificates-0x7e7 osppcext+0x5a648 @ 0x688ea648
_MsoWzFromIhtk@4+0x73207 mso+0x1404a94 @ 0x70f24a94
_MsoWzFromIhtk@4+0x72f96 mso+0x1404823 @ 0x70f24823
_MsoDwGimmeUserInstallBehavior@8+0x1ad15 _MsoHrShowMetSharedNotebooksDlg@20-0x7a9d0 mso+0xcc30d3 @ 0x707e30d3
_MsoDwGimmeUserInstallBehavior@8+0x1aa61 _MsoHrShowMetSharedNotebooksDlg@20-0x7ac84 mso+0xcc2e1f @ 0x707e2e1f
_MsoFreeCvsList@4+0x261dac _MsoPwlfFromFlinfo@8-0x3674 mso+0x4e2b05 @ 0x70002b05
_MsoFreeCvsList@4+0x2616fd _MsoPwlfFromFlinfo@8-0x3d23 mso+0x4e2456 @ 0x70002456
0x590202
_MsoDwGimmeUserInstallBehavior@8+0x1798b _MsoHrShowMetSharedNotebooksDlg@20-0x7dd5a mso+0xcbfd49 @ 0x707dfd49
_MsoHrSetupHTMLImport@8+0x27d9 _MsoHrOscServicesManagerSharepointURL@8-0x9611 mso+0x2008cc @ 0x6fd208cc
_MsoFIEPolicyAndVersion@8+0x37cd _MsoTelemetryOnEndVBAMacroCallback@0-0x3f32 mso+0x1efa61 @ 0x6fd0fa61
_MsoFIEPolicyAndVersion@8+0x3574 _MsoTelemetryOnEndVBAMacroCallback@0-0x418b mso+0x1ef808 @ 0x6fd0f808
_MsoFIEPolicyAndVersion@8+0x3534 _MsoTelemetryOnEndVBAMacroCallback@0-0x41cb mso+0x1ef7c8 @ 0x6fd0f7c8
_MsoFEnsureMsoTypelib@0+0x2a5 _MsoInitShrGlobal@4-0x1bdf mso+0x23b6d @ 0x6fb43b6d
_MsoExtTextOutW@32+0x85f _MsoFWndProcNeeded@4-0x4a1 mso+0x222ad @ 0x6fb422ad
_MsoFGetTbShowKbdShortcuts@0+0x8b11 _MsoFDigitCh@4-0xbf35 mso+0x1b522d @ 0x6fcd522d
_MsoFGetTbShowKbdShortcuts@0+0x8a6d _MsoFDigitCh@4-0xbfd9 mso+0x1b5189 @ 0x6fcd5189
_MsoFGetTbShowKbdShortcuts@0+0x795f _MsoFDigitCh@4-0xd0e7 mso+0x1b407b @ 0x6fcd407b
_MsoFGetTbShowKbdShortcuts@0+0x788d _MsoFDigitCh@4-0xd1b9 mso+0x1b3fa9 @ 0x6fcd3fa9
_MsoFGetTbShowKbdShortcuts@0+0x784f _MsoFDigitCh@4-0xd1f7 mso+0x1b3f6b @ 0x6fcd3f6b
DllGetClassObject+0x6de67 DllGetLCID-0x1df82c wwlib+0x72aca @ 0x72162aca
DllGetClassObject+0x6de29 DllGetLCID-0x1df86a wwlib+0x72a8c @ 0x72162a8c
DllGetClassObject+0x864b4 DllGetLCID-0x1c71df wwlib+0x8b117 @ 0x7217b117
DllGetClassObject+0x66a5f DllGetLCID-0x1e6c34 wwlib+0x6b6c2 @ 0x7215b6c2
DllGetClassObject+0x63c72 DllGetLCID-0x1e9a21 wwlib+0x688d5 @ 0x721588d5
wdCommandDispatch-0x370 winword+0x15c4 @ 0xef15c4
wdCommandDispatch-0x3dc winword+0x1558 @ 0xef1558
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xc004f011
exception.offset: 46887
exception.address: 0x7559b727
registers.esp: 3854680
registers.edi: 3854844
registers.eax: 3854680
registers.ebp: 3854760
registers.edx: 0
registers.ebx: 3855896
registers.esi: 3221549073
registers.ecx: 2147483648
1 0 0
Time & API Arguments Status Return Repeated

NtCreateFile

 create_disposition: 5 (FILE_OVERWRITE_IF)
file_handle: 0x00000484
filepath: C:\Users\test22\AppData\Local\Temp\~$Demo.dotx
desired_access: 0x40100080 (FILE_READ_ATTRIBUTES|SYNCHRONIZE|GENERIC_WRITE)
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$Demo.dotx
create_options: 4194400 (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT)
status_info: 2 (FILE_CREATED)
share_access: 0 ()
1 0 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 652
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 32 (PAGE_EXECUTE_READ)
base_address: 0x7ef50000
process_handle: 0xffffffff
1 0 0
host 192.3.108.47
parent_process winword.exe martian_process C:\Program Files (x86)\Microsoft Office\Office15\MSOSYNC.EXE
cmdline C:\Program Files (x86)\Microsoft Office\Office15\MSOSYNC.EXE
mutex Local\Microsoft_Office_15CSI_WDW:{C6EB2E17-00D0-45DD-BBD0-F8BB26EB9749}
mutex Local\Microsoft_Office_15CSI_WDW:{4822FB33-5195-4460-8D50-40B6E92F40E2}
mutex Local\Microsoft_Office_15Csi_CTTxnTableLock:{64E3F1BC-9C50-485C-A409-59A90E46B2B7}:TID{16284F64-D1CB-4015-ACFA-9E3944D6B6DD}
mutex Local\Microsoft_Office_15CSI_OMTX:{271A9400-8BD0-4DF3-9BA9-A0BC7BC8C502}
mutex Local\Microsoft_Office_15CSI_WDW:{AB5ED2A7-BB8C-4A8A-A7E6-45645AAEA57C}
mutex Global\Microsoft_Office_15Csi:GC:C:/Users/test22/AppData/Local/Microsoft/Office/15.0/OfficeFileCache/LocalCacheFileEditManager/FSF-{0E1EEE64-E8C6-4E2A-9759-63CF07FD8988}.FSF
mutex Local\Microsoft_Office_15Csi_CTTxnTableLock:{64E3F1BC-9C50-485C-A409-59A90E46B2B7}:TID{5585BD79-2A2B-4359-8F93-404ED6147369}
mutex Local\Microsoft_Office_15Csi_TableRuntimeBucketsLock:{4C8DD26B-2A38-4C5E-B8F7-DA4E2226F7A4}
mutex Local\Microsoft_Office_15CSI_OMTX:{4822FB33-5195-4460-8D50-40B6E92F40E2}
mutex Local\Microsoft_Office_15Csi_CTTxnTableLock:{64E3F1BC-9C50-485C-A409-59A90E46B2B7}:TID{7A3B9BC8-95AF-498B-A58A-AB578703D72A}
mutex Local\Microsoft_Office_15Csi_CTTxnTableLock:{64E3F1BC-9C50-485C-A409-59A90E46B2B7}:TID{BFCEF68A-3F40-481B-B237-FD551CEC6C8A}
mutex Local\Microsoft_Office_15Csi_CTTxnTableLock:{64E3F1BC-9C50-485C-A409-59A90E46B2B7}:TID{4A6D6FD4-6B5E-4B91-B650-BF1EC9669D4C}
mutex Local\Microsoft_Office_15Csi_CTTxnTableLock:{64E3F1BC-9C50-485C-A409-59A90E46B2B7}:TID{F85AF7C9-265C-434D-ACAE-E783DFE17053}
mutex Local\Microsoft_Office_15Csi_CTTxnTableLock:{64E3F1BC-9C50-485C-A409-59A90E46B2B7}:TID{48DEC616-56E4-4F30-8030-C51111C102A9}
mutex Local\Microsoft_Office_15CSI_WDW:{22C3D58D-F1D5-45AE-8096-FBD6DF3D6A14}
mutex Local\Microsoft_Office_15Csi_CTTxnTableLock:{64E3F1BC-9C50-485C-A409-59A90E46B2B7}:TID{D0A49606-3BBC-45A0-A810-6E7F9720E394}
mutex Local\Microsoft_Office_15CSI_WDW:{7F8704F0-0A46-4E7C-9801-35B0CFA85238}
mutex Local\Microsoft_Office_15CSI_WDW:{B796C26E-6ABB-42E6-9691-0DD17D833B00}
mutex Local\Microsoft_Office_15CSI_WDW:{271A9400-8BD0-4DF3-9BA9-A0BC7BC8C502}
mutex Local\Microsoft_Office_15CSI_WDW:{22780155-E954-42D8-A63A-FCDD7CC9EF23}
mutex Local\Microsoft_Office_15CSI_WDW:{4C8DD26B-2A38-4C5E-B8F7-DA4E2226F7A4}
mutex Local\Microsoft_Office_15CSI_OMTX:{B796C26E-6ABB-42E6-9691-0DD17D833B00}
udp {u'src': u'192.168.56.103', u'dst': u'239.255.255.250', u'offset': 216808, u'time': 15.285125017166138, u'dport': 1900, u'sport': 52764}