Analysis Report INV3867196801-20210111675616.xlsm

Overview

General Information

Sample Name: INV3867196801-20210111675616.xlsm
Analysis ID: 338155
MD5: 9b7c2b0abf5478ef9a23d9a9e87c7835
SHA1: 6931c4b845a8a952699d9cf85b316e3b3d826a41
SHA256: a463f9a8842a5c947abaa2bff1b621835ff35f65f9d3272bf1fa5197df9f07d0

Most interesting Screenshot:

Detection

Hidden Macro 4.0 Dridex
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Detected Dridex e-Banking trojan
Document exploit detected (creates forbidden files)
Document exploit detected (drops PE files)
Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: BlueMashroom DLL Load
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Document contains an embedded VBA macro which may execute processes
Document exploit detected (UrlDownloadToFile)
Document exploit detected (process start blacklist hit)
Found Excel 4.0 Macro with suspicious formulas
Machine Learning detection for dropped file
Office process drops PE file
Sigma detected: Microsoft Office Product Spawning Windows Shell
Sigma detected: Regsvr32 Anomaly
Adds / modifies Windows certificates
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
Contains functionality to query network adapater information
Contains functionality to read the PEB
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Document contains an embedded VBA macro which executes code when the document is opened / closed
Document contains embedded VBA macros
Drops PE files
Drops certificate files (DER)
Drops files with a non-matching file extension (content does not match file extension)
Found dropped PE file which has not been started or loaded
Found evasive API chain checking for process token information
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
One or more processes crash
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the installation date of Windows
Registers a DLL
Uses code obfuscation techniques (call, push, ret)

Classification

AV Detection:

barindex
Found malware configuration
Source: 4.2.regsvr32.exe.270000.1.raw.unpack Malware Configuration Extractor: Dridex {"Config: ": ["--------------------------------------------------", "BOT ID", "--------------------------------------------------", "Bot id : 61074", "--------------------------------------------------", "IP Address table", "--------------------------------------------------", "Address count 0"]}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\d4bfa7nne[1].zip ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\jczxic.dll ReversingLabs: Detection: 36%
Multi AV Scanner detection for submitted file
Source: INV3867196801-20210111675616.xlsm Virustotal: Detection: 33% Perma Link
Source: INV3867196801-20210111675616.xlsm ReversingLabs: Detection: 32%
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\jczxic.dll Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\d4bfa7nne[1].zip Joe Sandbox ML: detected
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: unknown HTTPS traffic detected: 185.2.4.104:443 -> 192.168.2.22:49165 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49168 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49172 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49176 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49180 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49184 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49188 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49192 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49196 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49200 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49204 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49208 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49212 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49216 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49216 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49220 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49224 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49230 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49234 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49238 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49242 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49246 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49250 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49254 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49258 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49262 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49266 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49270 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49274 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49278 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49282 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49286 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49290 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49294 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49298 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49302 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49306 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49310 version: TLS 1.2
Source: unknown HTTPS traffic detected: 192.168.2.22:49310 -> 77.220.64.37:443 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49314 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49318 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49322 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49326 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49330 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49334 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49338 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49342 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49346 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49350 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49354 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49358 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49362 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49366 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49370 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49374 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49378 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49382 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49386 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49390 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49394 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49398 version: TLS 1.2
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002DCEF8 FindFirstFileExW, 4_2_002DCEF8

Software Vulnerabilities:

barindex
Document exploit detected (creates forbidden files)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\jczxic.dll Jump to behavior
Document exploit detected (drops PE files)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: d4bfa7nne[1].zip.0.dr Jump to dropped file
Document exploit detected (UrlDownloadToFile)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Section loaded: \KnownDlls\api-ms-win-downlevel-shlwapi-l2-1-0.dll origin: URLDownloadToFileA Jump to behavior
Document exploit detected (process start blacklist hit)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\regsvr32.exe Jump to behavior
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: www5.ritamartins.pt
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 185.2.4.104:443
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 185.2.4.104:443

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49168
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49169
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49170
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49170
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49172
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49173
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49174
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49174
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49176
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49177
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49178
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49178
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49180
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49181
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49182
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49182
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49184
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49185
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49186
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49186
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49188
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49189
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49190
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49190
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49192
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49193
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49194
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49194
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49196
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49197
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49198
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49198
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49200
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49201
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49202
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49202
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49204
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49205
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49206
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49206
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49208
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49209
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49210
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49210
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49212
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49213
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49214
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49214
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49216
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49217
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49218
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49218
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49220
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49221
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49222
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49222
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49224
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49225
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49227
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49227
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49230
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49231
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49232
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49232
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49234
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49235
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49236
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49236
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49238
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49239
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49240
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49240
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49242
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49243
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49244
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49244
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49246
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49247
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49248
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49248
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49250
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49251
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49252
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49252
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49254
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49255
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49256
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49256
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49258
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49259
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49260
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49260
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49262
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49263
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49264
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49264
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49266
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49267
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49268
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49268
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49270
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49271
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49272
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49272
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49274
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49275
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49276
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49276
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49278
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49279
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49280
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49280
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49282
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49283
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49284
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49284
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49286
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49287
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49288
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49288
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49290
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49291
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49292
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49292
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49294
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49295
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49296
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49296
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49298
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49299
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49300
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49300
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49302
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49303
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49304
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49304
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49306
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49307
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49308
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49308
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49310
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49311
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49312
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49312
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49314
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49315
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49316
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49316
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49318
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49319
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49320
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49320
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49322
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49323
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49324
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49324
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49326
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49327
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49328
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49328
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49330
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49331
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49332
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49332
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49334
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49335
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49336
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49336
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49338
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49339
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49340
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49340
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49342
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49343
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49344
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49344
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49346
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49347
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49348
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49348
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49350
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49351
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49352
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49352
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49354
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49355
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49356
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49356
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49358
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49359
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49360
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49360
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49362
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49363
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49364
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49364
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49366
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49367
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49368
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49368
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49370
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49371
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49372
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49372
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49374
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49375
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49376
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49376
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49378
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49379
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49380
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49380
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49382
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49383
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49384
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49384
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49386
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49387
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49388
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49388
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49390
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49391
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49392
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49392
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49394
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49395
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49396
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49396
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49398
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49399
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49400
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49400
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 80.86.91.27:3308
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 5.100.228.233:3389
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 46.105.131.65:1512
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 5.100.228.233 5.100.228.233
Source: Joe Sandbox View IP Address: 80.86.91.27 80.86.91.27
Source: Joe Sandbox View IP Address: 46.105.131.65 46.105.131.65
Source: Joe Sandbox View IP Address: 77.220.64.37 77.220.64.37
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: SENTIANL SENTIANL
Source: Joe Sandbox View ASN Name: GD-EMEA-DC-SXB1DE GD-EMEA-DC-SXB1DE
Source: Joe Sandbox View ASN Name: OVHFR OVHFR
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b
Source: Joe Sandbox View JA3 fingerprint: eb88d0b3e1961a0562f006e5ce2a0b87
Source: unknown TCP traffic detected without corresponding DNS query: 77.220.64.37
Source: unknown TCP traffic detected without corresponding DNS query: 77.220.64.37
Source: unknown TCP traffic detected without corresponding DNS query: 77.220.64.37
Source: unknown TCP traffic detected without corresponding DNS query: 77.220.64.37
Source: unknown TCP traffic detected without corresponding DNS query: 77.220.64.37
Source: unknown TCP traffic detected without corresponding DNS query: 77.220.64.37
Source: unknown TCP traffic detected without corresponding DNS query: 77.220.64.37
Source: unknown TCP traffic detected without corresponding DNS query: 77.220.64.37
Source: unknown TCP traffic detected without corresponding DNS query: 77.220.64.37
Source: unknown TCP traffic detected without corresponding DNS query: 77.220.64.37
Source: unknown TCP traffic detected without corresponding DNS query: 77.220.64.37
Source: unknown TCP traffic detected without corresponding DNS query: 80.86.91.27
Source: unknown TCP traffic detected without corresponding DNS query: 80.86.91.27
Source: unknown TCP traffic detected without corresponding DNS query: 80.86.91.27
Source: unknown TCP traffic detected without corresponding DNS query: 80.86.91.27
Source: unknown TCP traffic detected without corresponding DNS query: 80.86.91.27
Source: unknown TCP traffic detected without corresponding DNS query: 80.86.91.27
Source: unknown TCP traffic detected without corresponding DNS query: 80.86.91.27
Source: unknown TCP traffic detected without corresponding DNS query: 80.86.91.27
Source: unknown TCP traffic detected without corresponding DNS query: 80.86.91.27
Source: unknown TCP traffic detected without corresponding DNS query: 80.86.91.27
Source: unknown TCP traffic detected without corresponding DNS query: 80.86.91.27
Source: unknown TCP traffic detected without corresponding DNS query: 5.100.228.233
Source: unknown TCP traffic detected without corresponding DNS query: 5.100.228.233
Source: unknown TCP traffic detected without corresponding DNS query: 5.100.228.233
Source: unknown TCP traffic detected without corresponding DNS query: 5.100.228.233
Source: unknown TCP traffic detected without corresponding DNS query: 5.100.228.233
Source: unknown TCP traffic detected without corresponding DNS query: 5.100.228.233
Source: unknown TCP traffic detected without corresponding DNS query: 5.100.228.233
Source: unknown TCP traffic detected without corresponding DNS query: 5.100.228.233
Source: unknown TCP traffic detected without corresponding DNS query: 5.100.228.233
Source: unknown TCP traffic detected without corresponding DNS query: 5.100.228.233
Source: unknown TCP traffic detected without corresponding DNS query: 5.100.228.233
Source: unknown TCP traffic detected without corresponding DNS query: 46.105.131.65
Source: unknown TCP traffic detected without corresponding DNS query: 46.105.131.65
Source: unknown TCP traffic detected without corresponding DNS query: 46.105.131.65
Source: unknown TCP traffic detected without corresponding DNS query: 46.105.131.65
Source: unknown TCP traffic detected without corresponding DNS query: 46.105.131.65
Source: unknown TCP traffic detected without corresponding DNS query: 46.105.131.65
Source: unknown TCP traffic detected without corresponding DNS query: 46.105.131.65
Source: unknown TCP traffic detected without corresponding DNS query: 46.105.131.65
Source: unknown TCP traffic detected without corresponding DNS query: 46.105.131.65
Source: unknown TCP traffic detected without corresponding DNS query: 46.105.131.65
Source: unknown TCP traffic detected without corresponding DNS query: 46.105.131.65
Source: unknown TCP traffic detected without corresponding DNS query: 77.220.64.37
Source: unknown TCP traffic detected without corresponding DNS query: 77.220.64.37
Source: unknown TCP traffic detected without corresponding DNS query: 77.220.64.37
Source: unknown TCP traffic detected without corresponding DNS query: 77.220.64.37
Source: unknown TCP traffic detected without corresponding DNS query: 77.220.64.37
Source: unknown TCP traffic detected without corresponding DNS query: 77.220.64.37
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002E39F9 InternetReadFile, 4_2_002E39F9
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\9BAE4728.emf Jump to behavior
Source: regsvr32.exe, 00000004.00000002.2387974585.00000000008E3000.00000004.00000020.sdmp String found in binary or memory: /moc.nideknil.wwwwww.linkedin.com equals www.linkedin.com (Linkedin)
Source: DWWIN.EXE, 00000007.00000002.2240906832.0000000003450000.00000002.00000001.sdmp String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)
Source: regsvr32.exe, 00000004.00000002.2387974585.00000000008E3000.00000004.00000020.sdmp String found in binary or memory: www.linkedin.com equals www.linkedin.com (Linkedin)
Source: regsvr32.exe, 00000004.00000002.2387974585.00000000008E3000.00000004.00000020.sdmp, DWWIN.EXE, 00000007.00000003.2236762354.00000000029AD000.00000004.00000001.sdmp String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)
Source: unknown DNS traffic detected: queries for: www5.ritamartins.pt
Source: E0F5C59F9FA661F6F4C50B87FEF3A15A.0.dr String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c
Source: 3C428B1A3E5F57D887EC4B864FAC5DCC.7.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt
Source: DWWIN.EXE, 00000007.00000003.2236762354.00000000029AD000.00000004.00000001.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: regsvr32.exe, 00000004.00000002.2387974585.00000000008E3000.00000004.00000020.sdmp, DWWIN.EXE, 00000007.00000002.2238170187.0000000002960000.00000004.00000001.sdmp String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: regsvr32.exe, 00000004.00000002.2387974585.00000000008E3000.00000004.00000020.sdmp, DWWIN.EXE, 00000007.00000002.2238170187.0000000002960000.00000004.00000001.sdmp String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: regsvr32.exe, 00000004.00000002.2387974585.00000000008E3000.00000004.00000020.sdmp, DWWIN.EXE, 00000007.00000003.2236762354.00000000029AD000.00000004.00000001.sdmp String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: regsvr32.exe, 00000004.00000002.2387974585.00000000008E3000.00000004.00000020.sdmp, DWWIN.EXE, 00000007.00000003.2236762354.00000000029AD000.00000004.00000001.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: regsvr32.exe, 00000004.00000002.2387974585.00000000008E3000.00000004.00000020.sdmp, DWWIN.EXE, 00000007.00000003.2236762354.00000000029AD000.00000004.00000001.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: regsvr32.exe, 00000004.00000002.2387974585.00000000008E3000.00000004.00000020.sdmp, DWWIN.EXE, 00000007.00000003.2236863472.0000000000171000.00000004.00000001.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: DWWIN.EXE, 00000007.00000003.2236762354.00000000029AD000.00000004.00000001.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: DWWIN.EXE, 00000007.00000003.2236762354.00000000029AD000.00000004.00000001.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: regsvr32.exe, 00000004.00000002.2387974585.00000000008E3000.00000004.00000020.sdmp, DWWIN.EXE, 00000007.00000002.2237170577.0000000000174000.00000004.00000020.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: regsvr32.exe, 00000004.00000002.2387974585.00000000008E3000.00000004.00000020.sdmp, DWWIN.EXE, 00000007.00000003.2236863472.0000000000171000.00000004.00000001.sdmp, 77EC63BDA74BD0D0E0426DC8F8008506.0.dr String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: DWWIN.EXE, 00000007.00000002.2240906832.0000000003450000.00000002.00000001.sdmp String found in binary or memory: http://investor.msn.com
Source: DWWIN.EXE, 00000007.00000002.2240906832.0000000003450000.00000002.00000001.sdmp String found in binary or memory: http://investor.msn.com/
Source: DWWIN.EXE, 00000007.00000002.2241208427.0000000003637000.00000002.00000001.sdmp String found in binary or memory: http://localizability/practices/XML.asp
Source: DWWIN.EXE, 00000007.00000002.2241208427.0000000003637000.00000002.00000001.sdmp String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: regsvr32.exe, 00000004.00000002.2387974585.00000000008E3000.00000004.00000020.sdmp, DWWIN.EXE, 00000007.00000003.2236762354.00000000029AD000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.comodoca.com0
Source: regsvr32.exe, 00000004.00000002.2387974585.00000000008E3000.00000004.00000020.sdmp, DWWIN.EXE, 00000007.00000003.2236863472.0000000000171000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.comodoca.com0%
Source: regsvr32.exe, 00000004.00000002.2387974585.00000000008E3000.00000004.00000020.sdmp, DWWIN.EXE, 00000007.00000003.2236762354.00000000029AD000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.comodoca.com0-
Source: regsvr32.exe, 00000004.00000002.2387974585.00000000008E3000.00000004.00000020.sdmp, DWWIN.EXE, 00000007.00000003.2236762354.00000000029AD000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.comodoca.com0/
Source: regsvr32.exe, 00000004.00000002.2387974585.00000000008E3000.00000004.00000020.sdmp, DWWIN.EXE, 00000007.00000002.2238170187.0000000002960000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.comodoca.com05
Source: DWWIN.EXE, 00000007.00000003.2236762354.00000000029AD000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.digicert.com0
Source: regsvr32.exe, 00000004.00000002.2387974585.00000000008E3000.00000004.00000020.sdmp, DWWIN.EXE, 00000007.00000003.2236762354.00000000029AD000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.entrust.net03
Source: regsvr32.exe, 00000004.00000002.2387974585.00000000008E3000.00000004.00000020.sdmp, DWWIN.EXE, 00000007.00000002.2238170187.0000000002960000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.entrust.net0D
Source: regsvr32.exe, 00000004.00000002.2388405613.00000000023D0000.00000002.00000001.sdmp, DWWIN.EXE, 00000007.00000002.2241751629.00000000040C0000.00000002.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: regsvr32.exe, 00000003.00000002.2387778399.0000000001D40000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.2388107432.0000000001F00000.00000002.00000001.sdmp, DWWIN.EXE, 00000007.00000002.2237799499.0000000002320000.00000002.00000001.sdmp String found in binary or memory: http://servername/isapibackend.dll
Source: DWWIN.EXE, 00000007.00000002.2241208427.0000000003637000.00000002.00000001.sdmp String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: DWWIN.EXE, 00000007.00000002.2241208427.0000000003637000.00000002.00000001.sdmp String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: regsvr32.exe, 00000004.00000002.2388405613.00000000023D0000.00000002.00000001.sdmp, DWWIN.EXE, 00000007.00000002.2241751629.00000000040C0000.00000002.00000001.sdmp String found in binary or memory: http://www.%s.comPA
Source: regsvr32.exe, 00000004.00000002.2387974585.00000000008E3000.00000004.00000020.sdmp, DWWIN.EXE, 00000007.00000002.2238170187.0000000002960000.00000004.00000001.sdmp String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: regsvr32.exe, 00000004.00000002.2387974585.00000000008E3000.00000004.00000020.sdmp, DWWIN.EXE, 00000007.00000003.2236762354.00000000029AD000.00000004.00000001.sdmp String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: DWWIN.EXE, 00000007.00000002.2240906832.0000000003450000.00000002.00000001.sdmp String found in binary or memory: http://www.hotmail.com/oe
Source: DWWIN.EXE, 00000007.00000002.2241208427.0000000003637000.00000002.00000001.sdmp String found in binary or memory: http://www.icra.org/vocabulary/.
Source: DWWIN.EXE, 00000007.00000002.2240906832.0000000003450000.00000002.00000001.sdmp String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: DWWIN.EXE, 00000007.00000002.2240906832.0000000003450000.00000002.00000001.sdmp String found in binary or memory: http://www.windows.com/pctv.
Source: regsvr32.exe, 00000004.00000002.2388056485.0000000000947000.00000004.00000020.sdmp String found in binary or memory: https://46.105.131.65/k
Source: regsvr32.exe, 00000004.00000002.2388056485.0000000000947000.00000004.00000020.sdmp String found in binary or memory: https://46.105.131.65/u
Source: regsvr32.exe, 00000004.00000002.2387974585.00000000008E3000.00000004.00000020.sdmp String found in binary or memory: https://46.105.131.65:1512/
Source: regsvr32.exe, 00000004.00000002.2388056485.0000000000947000.00000004.00000020.sdmp String found in binary or memory: https://5.100.228.233/
Source: regsvr32.exe, 00000004.00000002.2388056485.0000000000947000.00000004.00000020.sdmp String found in binary or memory: https://5.100.228.233/N
Source: regsvr32.exe, 00000004.00000002.2387949260.00000000008AF000.00000004.00000020.sdmp String found in binary or memory: https://5.100.228.233:3389/
Source: regsvr32.exe, 00000004.00000002.2387949260.00000000008AF000.00000004.00000020.sdmp String found in binary or memory: https://5.100.228.233:3389/4V
Source: regsvr32.exe, 00000004.00000002.2387974585.00000000008E3000.00000004.00000020.sdmp String found in binary or memory: https://77.220.64.37/Bf
Source: regsvr32.exe, 00000004.00000002.2387974585.00000000008E3000.00000004.00000020.sdmp String found in binary or memory: https://77.220.64.37/Kf
Source: regsvr32.exe, 00000004.00000002.2388056485.0000000000947000.00000004.00000020.sdmp String found in binary or memory: https://80.86.91.27/K
Source: regsvr32.exe, 00000004.00000002.2388056485.0000000000947000.00000004.00000020.sdmp String found in binary or memory: https://80.86.91.27/x
Source: regsvr32.exe, 00000004.00000002.2387974585.00000000008E3000.00000004.00000020.sdmp String found in binary or memory: https://80.86.91.27:3308/
Source: regsvr32.exe, 00000004.00000002.2387974585.00000000008E3000.00000004.00000020.sdmp, DWWIN.EXE, 00000007.00000002.2238170187.0000000002960000.00000004.00000001.sdmp String found in binary or memory: https://secure.comodo.com/CPS0
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49346
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49224
Source: unknown Network traffic detected: HTTP traffic on port 49294 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49188
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49342
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49220
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49184
Source: unknown Network traffic detected: HTTP traffic on port 49204 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49180
Source: unknown Network traffic detected: HTTP traffic on port 49242 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49374 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49176 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49342 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49338
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49216
Source: unknown Network traffic detected: HTTP traffic on port 49302 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49334
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49212
Source: unknown Network traffic detected: HTTP traffic on port 49180 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49298
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49176
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49330
Source: unknown Network traffic detected: HTTP traffic on port 49262 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49188 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49294
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49172
Source: unknown Network traffic detected: HTTP traffic on port 49354 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49290
Source: unknown Network traffic detected: HTTP traffic on port 49224 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49282 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49238 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49322 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49208
Source: unknown Network traffic detected: HTTP traffic on port 49230 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49326
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49204
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49168
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49322
Source: unknown Network traffic detected: HTTP traffic on port 49330 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49200
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49165
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49286
Source: unknown Network traffic detected: HTTP traffic on port 49286 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49318 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49282
Source: unknown Network traffic detected: HTTP traffic on port 49338 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49386 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49258 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49168 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49318
Source: unknown Network traffic detected: HTTP traffic on port 49216 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49250 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49314
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49278
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49310
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49398
Source: unknown Network traffic detected: HTTP traffic on port 49165 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49274
Source: unknown Network traffic detected: HTTP traffic on port 49394 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49394
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49270
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49390
Source: unknown Network traffic detected: HTTP traffic on port 49208 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49196 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49278 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49310 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49366 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49270 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49306
Source: unknown Network traffic detected: HTTP traffic on port 49326 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49302
Source: unknown Network traffic detected: HTTP traffic on port 49290 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49266
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49386
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49262
Source: unknown Network traffic detected: HTTP traffic on port 49370 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49382
Source: unknown Network traffic detected: HTTP traffic on port 49200 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49246 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49378 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49172 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49298 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49306 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49346 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49184 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49220 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49258
Source: unknown Network traffic detected: HTTP traffic on port 49266 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49350 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49378
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49254
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49374
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49250
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49370
Source: unknown Network traffic detected: HTTP traffic on port 49358 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49234 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49246
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49366
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49242
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49362
Source: unknown Network traffic detected: HTTP traffic on port 49334 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49254 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49212 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49382 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49238
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49358
Source: unknown Network traffic detected: HTTP traffic on port 49398 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49234
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49354
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49230
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49196
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49350
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49192
Source: unknown Network traffic detected: HTTP traffic on port 49390 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49314 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49192 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49274 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49362 -> 443
Source: unknown HTTPS traffic detected: 185.2.4.104:443 -> 192.168.2.22:49165 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49168 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49172 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49176 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49180 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49184 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49188 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49192 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49196 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49200 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49204 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49208 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49212 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49216 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49216 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49220 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49224 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49230 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49234 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49238 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49242 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49246 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49250 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49254 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49258 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49262 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49266 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49270 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49274 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49278 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49282 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49286 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49290 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49294 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49298 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49302 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49306 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49310 version: TLS 1.2
Source: unknown HTTPS traffic detected: 192.168.2.22:49310 -> 77.220.64.37:443 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49314 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49318 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49322 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49326 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49330 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49334 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49338 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49342 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49346 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49350 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49354 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49358 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49362 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49366 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49370 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49374 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49378 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49382 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49386 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49390 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49394 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49398 version: TLS 1.2

E-Banking Fraud:

barindex
Detected Dridex e-Banking trojan
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002B5150 OutputDebugStringA,Sleep,OutputDebugStringA,OutputDebugStringA,Sleep,OutputDebugStringA,OutputDebugStringA,Sleep,OutputDebugStringA,OutputDebugStringA,Sleep,OutputDebugStringA,GetAdaptersInfo,LoadLibraryW, 4_2_002B5150
Drops certificate files (DER)
Source: C:\Windows\System32\DWWIN.EXE File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC Jump to dropped file

System Summary:

barindex
Document contains an embedded VBA macro which may execute processes
Source: VBA code instrumentation OLE, VBA macro: Module Module1, Function pagesREviewsd, API Run("moreP_ab") Name: pagesREviewsd
Source: VBA code instrumentation OLE, VBA macro: Module Module1, Function pagesREviewsd, API Run("moreP_ab") Name: pagesREviewsd
Found Excel 4.0 Macro with suspicious formulas
Source: INV3867196801-20210111675616.xlsm Initial sample: CALL
Source: INV3867196801-20210111675616.xlsm Initial sample: CALL
Source: INV3867196801-20210111675616.xlsm Initial sample: CALL
Source: INV3867196801-20210111675616.xlsm Initial sample: CALL
Office process drops PE file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\jczxic.dll Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\d4bfa7nne[1].zip Jump to dropped file
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Windows\SysWOW64\regsvr32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Contains functionality to call native functions
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002C22A0 NtDelayExecution, 4_2_002C22A0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002DBE30 NtClose, 4_2_002DBE30
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_001BB770 VirtualAlloc,VirtualAlloc,NtSetInformationProcess, 4_2_001BB770
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_001BBA14 NtSetInformationProcess, 4_2_001BBA14
Detected potential crypto function
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002B5150 4_2_002B5150
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002D1020 4_2_002D1020
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002CD030 4_2_002CD030
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002CE0A0 4_2_002CE0A0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002DDCA0 4_2_002DDCA0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002D50A0 4_2_002D50A0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002D4CA0 4_2_002D4CA0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002D5CB0 4_2_002D5CB0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002C88C0 4_2_002C88C0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002C8CC0 4_2_002C8CC0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002C98DA 4_2_002C98DA
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002BACD0 4_2_002BACD0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002CA0D0 4_2_002CA0D0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002C7564 4_2_002C7564
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002B1570 4_2_002B1570
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002BF9A0 4_2_002BF9A0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002CD980 4_2_002CD980
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002DD180 4_2_002DD180
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002CC590 4_2_002CC590
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002D89F0 4_2_002D89F0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002D71F0 4_2_002D71F0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002CFDD0 4_2_002CFDD0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002D0220 4_2_002D0220
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002DD620 4_2_002DD620
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002BCA10 4_2_002BCA10
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002DFA10 4_2_002DFA10
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002CA660 4_2_002CA660
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002D7660 4_2_002D7660
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002D2E60 4_2_002D2E60
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002B9E70 4_2_002B9E70
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002C9E70 4_2_002C9E70
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002D1240 4_2_002D1240
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002C8AB0 4_2_002C8AB0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002D1EB0 4_2_002D1EB0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002D26B0 4_2_002D26B0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002CAE80 4_2_002CAE80
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002CF6E0 4_2_002CF6E0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002CB6F0 4_2_002CB6F0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002C8EF0 4_2_002C8EF0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002D62F0 4_2_002D62F0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002DFA10 4_2_002DFA10
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002D3EC0 4_2_002D3EC0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002B6AD0 4_2_002B6AD0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002C96D0 4_2_002C96D0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002D1730 4_2_002D1730
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002D3B00 4_2_002D3B00
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002D9B10 4_2_002D9B10
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002C5B60 4_2_002C5B60
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002CBF50 4_2_002CBF50
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002CE3F0 4_2_002CE3F0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002C67C8 4_2_002C67C8
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002C83C0 4_2_002C83C0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002C7FC0 4_2_002C7FC0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002D7FC0 4_2_002D7FC0
Document contains an embedded VBA macro which executes code when the document is opened / closed
Source: INV3867196801-20210111675616.xlsm OLE, VBA macro line: Private Sub view_1_a_Layout(ByVal Index As Long)
Source: VBA code instrumentation OLE, VBA macro: Module Sheet1, Function view_1_a_Layout Name: view_1_a_Layout
Document contains embedded VBA macros
Source: INV3867196801-20210111675616.xlsm OLE indicator, VBA macros: true
One or more processes crash
Source: unknown Process created: C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE 'C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE' -x -s 2360
Source: DWWIN.EXE, 00000007.00000002.2240906832.0000000003450000.00000002.00000001.sdmp Binary or memory string: .VBPud<_
Source: classification engine Classification label: mal100.bank.expl.evad.winXLSM@9/23@1/5
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\Desktop\~$INV3867196801-20210111675616.xlsm Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1296
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\CVRDB41.tmp Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: INV3867196801-20210111675616.xlsm Virustotal: Detection: 33%
Source: INV3867196801-20210111675616.xlsm ReversingLabs: Detection: 32%
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Source: unknown Process created: C:\Windows\System32\regsvr32.exe 'C:\Windows\System32\regsvr32.exe' -s C:\Users\user\AppData\Local\Temp\jczxic.dll.
Source: unknown Process created: C:\Windows\SysWOW64\regsvr32.exe -s C:\Users\user\AppData\Local\Temp\jczxic.dll.
Source: unknown Process created: C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE 'C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE' -x -s 2360
Source: unknown Process created: C:\Windows\System32\DWWIN.EXE C:\Windows\system32\dwwin.exe -x -s 2360
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\regsvr32.exe 'C:\Windows\System32\regsvr32.exe' -s C:\Users\user\AppData\Local\Temp\jczxic.dll. Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE 'C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE' -x -s 2360 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Process created: C:\Windows\SysWOW64\regsvr32.exe -s C:\Users\user\AppData\Local\Temp\jczxic.dll. Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE Process created: C:\Windows\System32\DWWIN.EXE C:\Windows\system32\dwwin.exe -x -s 2360 Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{713AACC8-3B71-435C-A3A1-BE4E53621AB1}\InProcServer32 Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Automated click: OK
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Automated click: OK
Source: Window Recorder Window detected: More than 3 window changes detected
Source: INV3867196801-20210111675616.xlsm Initial sample: OLE zip file path = xl/media/image2.png
Source: INV3867196801-20210111675616.xlsm Initial sample: OLE zip file path = xl/printerSettings/printerSettings2.bin
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: INV3867196801-20210111675616.xlsm Initial sample: OLE indicators vbamacros = False

Data Obfuscation:

barindex
Contains functionality to dynamically determine API calls
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_10002140 LoadLibraryA,GetProcAddress,VirtualAlloc,VirtualAlloc,VirtualAlloc, 4_2_10002140
Registers a DLL
Source: unknown Process created: C:\Windows\System32\regsvr32.exe 'C:\Windows\System32\regsvr32.exe' -s C:\Users\user\AppData\Local\Temp\jczxic.dll.
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_1000400A push esi; retf 4_2_1000401D
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_10010810 pushfd ; retf 4_2_1001084E
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_1000D856 push ebp; retf 4_2_1000D85E
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_1000E8F3 pushad ; iretd 4_2_1000E8F4
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_10002140 push ecx; ret 4_2_100021B6
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_1001CD9B push esp; retf 4_2_1001CDB0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_1000C265 push 588A19FDh; iretd 4_2_1000C278
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_10020A73 push edx; iretd 4_2_10020A9C
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_1000FEBF push eax; iretd 4_2_1000FEC0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_1000FEFA push 00000000h; iretd 4_2_1000FF10
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_10023EFF push eax; iretd 4_2_10023F64
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_1000C304 push 588A1BCDh; iretd 4_2_1000C314
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_10010307 push esp; retf 4_2_10010308
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_1000CF15 push 0000002Dh; iretd 4_2_1000CF1C
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_1001DB23 push eax; iretd 4_2_1001DB34
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_10020B27 push eax; iretd 4_2_10020B28
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_1000DFC7 pushad ; iretd 4_2_1000DFC8
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_10023FEB push edx; ret 4_2_10024001
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_100107FB pushfd ; retf 4_2_1001084E
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_001BBFA0 push edx; ret 4_2_001BC259
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_00187172 push dword ptr [ebp+ecx*8-49h]; retf 4_2_00187176
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_001A62CD pushad ; iretd 4_2_001A62E5
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_0019F6CD push esi; ret 4_2_0019F6D7
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_0018899D push 00000369h; ret 4_2_00188A28
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_001889CD push 00000369h; ret 4_2_00188A28
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_001AFB74 push esi; ret 4_2_001AFB8B
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_00181D11 push FFFFFFD5h; ret 4_2_00181D18
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_00180E8F push esi; ret 4_2_00180E94

Persistence and Installation Behavior:

barindex
Drops PE files
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\jczxic.dll Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\d4bfa7nne[1].zip Jump to dropped file
Drops files with a non-matching file extension (content does not match file extension)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\d4bfa7nne[1].zip Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

barindex
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Windows\SysWOW64\regsvr32.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_001988DD rdtsc 4_2_001988DD
Contains functionality to query network adapater information
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: OutputDebugStringA,Sleep,OutputDebugStringA,OutputDebugStringA,Sleep,OutputDebugStringA,OutputDebugStringA,Sleep,OutputDebugStringA,OutputDebugStringA,Sleep,OutputDebugStringA,GetAdaptersInfo,LoadLibraryW, 4_2_002B5150
Found dropped PE file which has not been started or loaded
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\d4bfa7nne[1].zip Jump to dropped file
Found evasive API chain checking for process token information
Source: C:\Windows\SysWOW64\regsvr32.exe Check user administrative privileges: GetTokenInformation,DecisionNodes
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2936 Thread sleep time: -300000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -363000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -1032000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -260000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -355000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -684000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -531000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -278000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -792000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -314000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -304000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -319000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -644000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -588000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -492000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -978000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -344000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -280000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -652000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -480000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -357000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -384000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -340000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -316000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -504000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -568000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -261000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -348000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -438000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -297000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -298000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -1002000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -640000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -880000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -660000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -417000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -178000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -644000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -310000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -552000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -328000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -882000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -524000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -288000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -286000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -672000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -271000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -624000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -307000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -560000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -312000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -540000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -566000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -302000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -338000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -120000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -249000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -536000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -692000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -288000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -308000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -477000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -272000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -247000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -254000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -526000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -444000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -243000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -372000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -346000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -324000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -250000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -290000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -296000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -166000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -525000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -660000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -270000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -141000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -524000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -353000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -341000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -300000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -308000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -246000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -325000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -153000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -259000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -254000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -686000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -265000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -137000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -244000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -279000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -336000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -179000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -244000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -328000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -658000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -344000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -266000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -253000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -248000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2332 Thread sleep time: -241000s >= -30000s Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE TID: 2764 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002DCEF8 FindFirstFileExW, 4_2_002DCEF8
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002C3930 GetTokenInformation,GetTokenInformation,GetSystemInfo,GetTokenInformation, 4_2_002C3930
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_001988DD rdtsc 4_2_001988DD
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002C6C50 LdrLoadDll, 4_2_002C6C50
Contains functionality to dynamically determine API calls
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_10002140 LoadLibraryA,GetProcAddress,VirtualAlloc,VirtualAlloc,VirtualAlloc, 4_2_10002140
Contains functionality to read the PEB
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_001BB5D0 mov eax, dword ptr fs:[00000030h] 4_2_001BB5D0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_001BB6D0 mov eax, dword ptr fs:[00000030h] 4_2_001BB6D0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002C7A60 RtlAddVectoredExceptionHandler, 4_2_002C7A60

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\SysWOW64\regsvr32.exe Network Connect: 80.86.91.27 236 Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Network Connect: 5.100.228.233 61 Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Network Connect: 46.105.131.65 232 Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Network Connect: 77.220.64.37 187 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\regsvr32.exe Process created: C:\Windows\SysWOW64\regsvr32.exe -s C:\Users\user\AppData\Local\Temp\jczxic.dll. Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE Process created: C:\Windows\System32\DWWIN.EXE C:\Windows\system32\dwwin.exe -x -s 2360 Jump to behavior
Source: regsvr32.exe, 00000003.00000002.2387726953.0000000000940000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.2388068531.0000000000B00000.00000002.00000001.sdmp Binary or memory string: Program Manager
Source: regsvr32.exe, 00000003.00000002.2387726953.0000000000940000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.2388068531.0000000000B00000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: regsvr32.exe, 00000003.00000002.2387726953.0000000000940000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.2388068531.0000000000B00000.00000002.00000001.sdmp Binary or memory string: !Progman

Language, Device and Operating System Detection:

barindex
Queries the installation date of Windows
Source: C:\Windows\SysWOW64\regsvr32.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_002C2980 GetUserNameW, 4_2_002C2980
Source: C:\Windows\SysWOW64\regsvr32.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings:

barindex
Adds / modifies Windows certificates
Source: C:\Windows\SysWOW64\regsvr32.exe Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 Blob Jump to behavior