IOCReport

loading gif

Files

File Path
Type
Category
Malicious
SecuriteInfo.com.Exploit.Siggen3.10350.13127.xls
Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1251, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Fri Feb 19 10:48:36 2021, Security: 0
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\10[1].jjkes
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
downloaded
 malicious
C:\Users\user\BASE.BABAA
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
Microsoft Cabinet archive data, 59134 bytes, 1 file
dropped
 clean
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
data
dropped
 clean
C:\Users\user\AppData\Local\Temp\CBBE0000
data
dropped
 clean
C:\Users\user\AppData\Local\Temp\Cab20E9.tmp
Microsoft Cabinet archive data, 59134 bytes, 1 file
dropped
 clean
C:\Users\user\AppData\Local\Temp\Tar20EA.tmp
data
modified
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Tue Oct 17 10:04:00 2017, mtime=Sat Feb 20 10:16:34 2021, atime=Sat Feb 20 10:16:34 2021, length=16384, window=hide
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\SecuriteInfo.com.Exploit.Siggen3.10350.13127.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Sat Feb 20 10:16:21 2021, mtime=Sat Feb 20 10:16:34 2021, atime=Sat Feb 20 10:16:34 2021, length=168448, window=hide
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
ASCII text, with CRLF line terminators
dropped
 clean
C:\Users\user\Desktop\AEBE0000
Applesoft BASIC program data, first line number 16
dropped
 clean
There are 2 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
 malicious
C:\Windows\System32\rundll32.exe
rundll32 ..\BASE.BABAA,DllRegisterServer
 malicious
C:\Windows\SysWOW64\rundll32.exe
rundll32 ..\BASE.BABAA,DllRegisterServer
 malicious
C:\Windows\System32\wermgr.exe
C:\Windows\system32\wermgr.exe
 malicious
C:\Windows\System32\wermgr.exe
C:\Windows\system32\wermgr.exe
 malicious

URLs

Name
IP
Malicious
http://www.chipmania.it/mails/open.php
185.81.0.78
 malicious
http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
unknown
 clean
http://www.windows.com/pctv.
unknown
 clean
http://investor.msn.com
unknown
 clean
http://www.msnbc.com/news/ticker.txt
unknown
 clean
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
unknown
 clean
http://www.icra.org/vocabulary/.
unknown
 clean
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
unknown
 clean
http://crl.entrust.net/server1.crl0
unknown
 clean
http://ocsp.entrust.net03
unknown
 clean
http://investor.msn.com/
unknown
 clean
https://142.202.191.164/rob60/320946_W617601.F9BBFBBC7DBF7A22FB7533B3DADD73B3/5/file/
unknown
 clean
https://200.52.147.93/rob60/320946_W617601.F9BBFBBC7DBF7A22FB7533B3DADD73B3/5/file//
unknown
 clean
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
unknown
 clean
http://www.%s.comPA
unknown
 clean
http://www.diginotar.nl/cps/pkioverheid0
unknown
 clean
http://windowsmedia.com/redir/services.asp?WMPFriendly=true
unknown
 clean
http://www.hotmail.com/oe
unknown
 clean
http://ocsp.entrust.net0D
unknown
 clean
https://secure.comodo.com/CPS0
unknown
 clean
http://servername/isapibackend.dll
unknown
 clean
http://crl.entrust.net/2048ca.crl0
unknown
 clean
https://200.52.147.93/rob60/320946_W617601.F9BBFBBC7DBF7A22FB7533B3DADD73B3/5/file/
unknown
 clean
There are 13 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
chipmania.it
185.81.0.78
 clean
www.chipmania.it
unknown
 clean

IPs

IP
Domain
Country
Active
Malicious
142.202.191.164
unknown
Reserved
unknown
 malicious
108.170.20.75
unknown
United States
unknown
 malicious
200.52.147.93
unknown
Honduras
unknown
 malicious
185.81.0.78
unknown
Italy
unknown
 clean

Registry

Path
Value
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
)k7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
MTTT
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ReviewToken
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EB57A
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
VBAFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
DefaultSheetR2L
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
UseSystemSeparators
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ThousandsSeparator
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
DecimalSeparator
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EB98F
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EBB73
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EBE7F
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EBEEC
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
{E7E4BC40-E76A-11CE-A9BB-00AA004AE837} {000214E6-0000-0000-C000-000000000046} 0xFFFF
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
#x7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
F2FC7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
F342A
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
LastPurgeTime
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EXCELFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SavedLegacySettings
 clean
C:\Windows\System32\wermgr.exe
@%SystemRoot%\system32\qagentrt.dll,-10
 clean
C:\Windows\System32\wermgr.exe
@%SystemRoot%\System32\fveui.dll,-843
 clean
C:\Windows\System32\wermgr.exe
@%SystemRoot%\System32\fveui.dll,-844
 clean
C:\Windows\System32\wermgr.exe
@%SystemRoot%\System32\wuaueng.dll,-400
 clean
C:\Windows\System32\wermgr.exe
Blob
 clean
C:\Windows\System32\wermgr.exe
Blob
 clean
C:\Windows\System32\wermgr.exe
Blob
 clean
C:\Windows\System32\wermgr.exe
Blob
 clean
C:\Windows\System32\wermgr.exe
Blob
 clean
C:\Windows\System32\wermgr.exe
Blob
 clean
There are 105 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
764000
unkown
page read and write
 malicious
5D8000
unkown
page read and write
 malicious
130000
unkown
page execute and read and write
 malicious
730000
heap default
page read and write
 malicious
764000
unkown
page read and write
 malicious
338E0000
unkown
page readonly
 clean
33D61000
unkown
page read and write
 clean
334F0000
unkown
page readonly
 clean
25D000
heap default
page read and write
 clean
33D1C000
unkown
page read and write
 clean
20C0000
heap private
page read and write
 clean
1DB0000
unkown
page write copy
 clean
33D1C000
unkown
page read and write
 clean
60000
unkown
page execute and read and write
 clean
75A000
unkown
page read and write
 clean
33D80000
unkown
page read and write
 clean
1E4000
heap private
page read and write
 clean
790000
unkown
page read and write
 clean
1A6000
stack
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
7D0000
unkown
page readonly
 clean
33CC1000
unkown
page read and write
 clean
1EBB000
heap private
page read and write
 clean
1F0000
unkown
page execute and read and write
 clean
3D0000
unkown
page readonly
 clean
33CC0000
unkown
page read and write
 clean
6E869000
unkown image
page readonly
 clean
33470000
heap private
page read and write
 clean
C22000
heap private
page read and write
 clean
33D1C000
unkown
page read and write
 clean
330000
unkown
page read and write
 clean
33CF7000
unkown
page read and write
 clean
1D1F000
unkown
page read and write
 clean
2B0000
unkown
page execute and read and write
 clean
130000
unkown
page readonly
 clean
33D1C000
unkown
page read and write
 clean
770000
unkown
page read and write
 clean
32D3F000
unkown
page read and write
 clean
6E8A4000
unkown image
page readonly
 clean
6D7000
heap default
page read and write
 clean
1E7000
heap default
page read and write
 clean
33D15000
unkown
page read and write
 clean
74C000
unkown
page read and write
 clean
20000
unkown
page read and write
 clean
330000
unkown
page read and write
 clean
2D2000
unkown
page read and write
 clean
731000
unkown
page read and write
 clean
C40000
heap private
page read and write
 clean
430000
unkown
page readonly
 clean
1E0000
heap private
page read and write
 clean
20000
unkown
page readonly
 clean
250000
unkown
page execute and read and write
 clean
33D15000
unkown
page read and write
 clean
C04000
heap private
page read and write
 clean
33D1C000
unkown
page read and write
 clean
33D18000
unkown
page read and write
 clean
5B0000
unkown
page readonly
 clean
32C40000
heap private
page read and write
 clean
2C1000
heap default
page read and write
 clean
324000
heap private
page read and write
 clean
10001000
unkown
page execute and read and write
 clean
C00000
heap private
page read and write
 clean
1D2000
stack
page read and write
 clean
33D1C000
unkown
page read and write
 clean
3346C000
unkown
page read and write
 clean
6E88A000
unkown image
page read and write
 clean
33CE6000
unkown
page read and write
 clean
33AC7000
unkown
page readonly
 clean
3325F000
unkown
page read and write
 clean
150000
unkown
page read and write
 clean
32943000
heap private
page read and write
 clean
75A000
unkown
page read and write
 clean
1E80000
heap private
page read and write
 clean
590000
unkown
page read and write
 clean
33CDF000
unkown
page read and write
 clean
430000
unkown
page readonly
 clean
33D1C000
unkown
page read and write
 clean
33DC1000
unkown
page read and write
 clean
DC000
unkown
page read and write
 clean
33D20000
unkown
page read and write
 clean
73E000
unkown
page read and write
 clean
32E20000
unkown
page readonly
 clean
33D3C000
unkown
page read and write
 clean
731000
unkown
page read and write
 clean
33D1C000
unkown
page read and write
 clean
950000
unkown
page readonly
 clean
D20000
heap private
page read and write
 clean
770000
unkown
page read and write
 clean
2BF000
heap default
page read and write
 clean
1B0000
unkown
page readonly
 clean
731000
unkown
page read and write
 clean
1D30000
heap private
page read and write
 clean
1B50000
unkown
page readonly
 clean
33DE5000
unkown
page read and write
 clean
33D15000
unkown
page read and write
 clean
2B6000
heap default
page read and write
 clean
6E88C000
unkown image
page readonly
 clean
770000
unkown
page read and write
 clean
33D1C000
unkown
page read and write
 clean
90000
unkown
page readonly
 clean
32B41000
heap private
page read and write
 clean
330F0000
unkown
page readonly
 clean
1C0000
unkown
page read and write
 clean
33D15000
unkown
page read and write
 clean
33E03000
unkown
page read and write
 clean
33D17000
unkown
page read and write
 clean
32C41000
heap private
page read and write
 clean
E0000
unkown
page readonly
 clean
33DE5000
unkown
page read and write
 clean
26E000
heap default
page read and write
 clean
33483000
heap private
page read and write
 clean
12B000
unkown
page read and write
 clean
1F50000
heap private
page read and write
 clean
1B90000
heap private
page read and write
 clean
1D0000
unkown
page read and write
 clean
792000
unkown
page read and write
 clean
332E0000
heap private
page read and write
 clean
21E000
heap default
page read and write
 clean
33D1C000
unkown
page read and write
 clean
34450000
heap private
page read and write
 clean
A0000
unkown
page execute and read and write
 clean
750000
unkown
page readonly
 clean
1D0000
unkown
page read and write
 clean
320000
heap private
page read and write
 clean
240000
heap default
page read and write
 clean
1E0000
heap default
page read and write
 clean
6E440000
unkown image
page readonly
 clean
6D0000
heap default
page read and write
 clean
33D15000
unkown
page read and write
 clean
32C46000
heap private
page read and write
 clean
20000
unkown
page readonly
 clean
1D37000
unkown
page readonly
 clean
70D000
heap default
page read and write
 clean
33D15000
unkown
page read and write
 clean
366000
unkown
page read and write
 clean
1E85000
heap private
page read and write
 clean
770000
unkown
page read and write
 clean
100000
unkown
page read and write
 clean
160000
unkown
page read and write
 clean
731000
unkown
page read and write
 clean
33DC0000
unkown
page read and write
 clean
791000
unkown
page read and write
 clean
230000
heap default
page read and write
 clean
CCC000
unkown
page read and write
 clean
5B0000
unkown
page readonly
 clean
370000
heap private
page read and write
 clean
731000
unkown
page read and write
 clean
24A000
heap default
page read and write
 clean
120000
unkown
page readonly
 clean
6E440000
unkown image
page readonly
 clean
32E1E000
unkown
page read and write
 clean
2317000
unkown
page readonly
 clean
26F000
heap default
page read and write
 clean
792000
unkown
page read and write
 clean
510000
heap default
page read and write
 clean
707000
heap default
page read and write
 clean
34050000
unkown
page readonly
 clean
25A000
unkown
page read and write
 clean
237000
heap default
page read and write
 clean
366000
unkown
page read and write
 clean
32C7C000
heap private
page read and write
 clean
33D1A000
unkown
page read and write
 clean
33D1C000
unkown
page read and write
 clean
24C000
unkown
page read and write
 clean
1C9D000
unkown
page read and write
 clean
24B000
unkown
page read and write
 clean
180000
unkown
page readonly
 clean
6F4000
heap default
page read and write
 clean
33DC1000
unkown
page read and write
 clean
2130000
unkown
page readonly
 clean
320000
heap private
page read and write
 clean
6E441000
unkown image
page execute read
 clean
There are 162 hidden memdumps, click here to show them.