IOCReport

446446.xls

Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1251, Last Saved By: 5, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Mon Apr 12 15:51:16 2021, Security: 0

initial sample

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\SQCTO[1].perclick

PE32 executable (DLL) (native) Intel 80386, for MS Windows

downloaded

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\446446.xls.LNK

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Sep 30 14:03:46 2020, mtime=Mon Apr 12 23:12:27 2021, atime=Mon Apr 12 23:12:27 2021, length=110080, window=hide

dropped

C:\Users\user\fdinmd.fii

PE32 executable (DLL) (native) Intel 80386, for MS Windows

modified

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\4HeVw[1].perclick

PE32 executable (DLL) (native) Intel 80386, for MS Windows

downloaded

C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding

C:\Windows\SysWOW64\rundll32.exe

rundll32 ..\fdinmd.fii,StartW

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding

C:\Windows\System32\rundll32.exe

rundll32 ..\fdinmd.fii,StartW