IOCReport

loading gif

Files

File Path
Type
Category
Malicious
catalog-1521295750.xlsm
Microsoft Excel 2007+
initial sample
 malicious
C:\Users\user\Desktop\~$catalog-1521295750.xlsm
data
dropped
 malicious
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
Microsoft Cabinet archive data, 58596 bytes, 1 file
dropped
 clean
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A
data
dropped
 clean
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
data
dropped
 clean
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A
data
dropped
 clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\suspendedpage[1].htm
HTML document, ASCII text
downloaded
 clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\3E3BA770.png
PNG image data, 24 x 24, 8-bit/color RGB, non-interlaced
dropped
 clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\7318CC95.png
PNG image data, 205 x 58, 8-bit/color RGB, non-interlaced
dropped
 clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\896006B.png
PNG image data, 24 x 24, 8-bit/color RGB, non-interlaced
dropped
 clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\B452C192.png
PNG image data, 485 x 185, 8-bit/color RGB, non-interlaced
dropped
 clean
C:\Users\user\AppData\Local\Temp\CabE199.tmp
Microsoft Cabinet archive data, 58596 bytes, 1 file
dropped
 clean
C:\Users\user\AppData\Local\Temp\D9DE0000
data
dropped
 clean
C:\Users\user\AppData\Local\Temp\TarE19A.tmp
data
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Tue Oct 17 10:04:00 2017, mtime=Tue May 4 11:25:41 2021, atime=Tue May 4 11:25:41 2021, length=8192, window=hide
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\catalog-1521295750.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:14 2020, mtime=Tue May 4 11:25:41 2021, atime=Tue May 4 11:25:41 2021, length=109034, window=hide
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
ASCII text, with CRLF line terminators
dropped
 clean
C:\Users\user\Desktop\9ADE0000
data
dropped
 clean
C:\Users\user\jordji.nbvt11
HTML document, ASCII text
dropped
 clean
There are 9 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
 malicious
C:\Windows\System32\rundll32.exe
rundll32 ..\jordji.nbvt1,DllRegisterServer
 malicious
C:\Windows\System32\rundll32.exe
rundll32 ..\jordji.nbvt11,DllRegisterServer
 malicious

URLs

Name
IP
Malicious
http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
unknown
 clean
http://www.windows.com/pctv.
unknown
 clean
http://investor.msn.com
unknown
 clean
http://www.msnbc.com/news/ticker.txt
unknown
 clean
http://www.icra.org/vocabulary/.
unknown
 clean
http://windowsmedia.com/redir/services.asp?WMPFriendly=true
unknown
 clean
http://www.hotmail.com/oe
unknown
 clean
http://fwdssp.com/?dn=referer_detect&pid=5POL4F2O4
unknown
 clean
http://investor.msn.com/
unknown
 clean

Domains

Name
IP
Malicious
dentistelmhurstny.com
192.185.5.2
 clean
legalopspr.com
192.185.20.98
 clean

IPs

IP
Domain
Country
Malicious
192.185.5.2
dentistelmhurstny.com
United States
clean
192.185.20.98
legalopspr.com
United States
clean

Registry

Path
Value
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
f`4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
MTTT
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ReviewToken
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ED4BD
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
VBAFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
DefaultSheetR2L
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
UseSystemSeparators
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ThousandsSeparator
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
DecimalSeparator
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ED817
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ED8D2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ED97E
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EDA68
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EDB13
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
{E7E4BC40-E76A-11CE-A9BB-00AA004AE837} {000214E6-0000-0000-C000-000000000046} 0xFFFF
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
k4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\system32\qagentrt.dll,-10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\System32\fveui.dll,-843
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\System32\fveui.dll,-844
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\System32\wuaueng.dll,-400
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
LastPurgeTime
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
103331
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
104403
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EXCELFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SavedLegacySettings
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
There are 113 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
70000
unkown
page read and write
 clean
2135000
heap private
page read and write
 clean
2814000
unkown
page readonly
 clean
1DA7000
unkown
page readonly
 clean
2BE0000
unkown
page readonly
 clean
2835000
unkown
page readonly
 clean
306000
unkown
page read and write
 clean
2130000
heap private
page read and write
 clean
33D000
heap default
page read and write
 clean
2B40000
unkown
page readonly
 clean
2822000
unkown
page readonly
 clean
27F4000
unkown
page readonly
 clean
2982000
unkown
page readonly
 clean
20000
unkown
page readonly
 clean
28E2000
unkown
page readonly
 clean
2975000
unkown
page readonly
 clean
2270000
unkown
page readonly
 clean
2230000
heap private
page read and write
 clean
2952000
unkown
page readonly
 clean
28A6000
unkown
page readonly
 clean
2120000
unkown
page write copy
 clean
620000
unkown
page readonly
 clean
2865000
unkown
page readonly
 clean
44E000
heap default
page read and write
 clean
21D9000
heap private
page read and write
 clean
293D000
unkown
page readonly
 clean
300000
heap default
page read and write
 clean
2832000
unkown
page readonly
 clean
3D0000
unkown
page write copy
 clean
2658000
unkown
page readonly
 clean
2A6000
unkown
page read and write
 clean
307000
heap default
page read and write
 clean
690000
unkown
page readonly
 clean
E0000
unkown
page read and write
 clean
27B4000
unkown
page readonly
 clean
160000
heap private
page read and write
 clean
29A5000
unkown
page readonly
 clean
417000
heap default
page read and write
 clean
27B2000
unkown
page readonly
 clean
60000
unkown
page readonly
 clean
34B000
heap default
page read and write
 clean
2852000
unkown
page readonly
 clean
B2F000
unkown
page read and write
 clean
2B60000
unkown
page readonly
 clean
3080000
unkown
page read and write
 clean
204000
heap private
page read and write
 clean
28B2000
unkown
page readonly
 clean
2812000
unkown
page readonly
 clean
2020000
heap private
page read and write
 clean
164000
heap private
page read and write
 clean
2915000
unkown
page readonly
 clean
2F30000
unkown
page read and write
 clean
2852000
unkown
page readonly
 clean
2D35000
heap private
page read and write
 clean
1C30000
unkown
page readonly
 clean
2BC0000
unkown
page readonly
 clean
28F2000
unkown
page readonly
 clean
270000
unkown
page read and write
 clean
2854000
unkown
page readonly
 clean
400000
unkown
page read and write
 clean
346000
heap default
page read and write
 clean
2752000
unkown
page readonly
 clean
490000
heap private
page read and write
 clean
20000
unkown
page readonly
 clean
28D6000
unkown
page readonly
 clean
29D5000
unkown
page readonly
 clean
2876000
unkown
page readonly
 clean
2882000
unkown
page readonly
 clean
216B000
heap private
page read and write
 clean
28F5000
unkown
page readonly
 clean
2B20000
unkown
page readonly
 clean
167000
heap default
page read and write
 clean
2989000
unkown
page readonly
 clean
436000
unkown
page read and write
 clean
27D4000
unkown
page readonly
 clean
160000
heap default
page read and write
 clean
2B80000
unkown
page readonly
 clean
22D0000
unkown
page readonly
 clean
14D000
unkown
page read and write
 clean
28D6000
unkown
page readonly
 clean
2D30000
heap private
page read and write
 clean
21D5000
heap private
page read and write
 clean
2895000
unkown
page readonly
 clean
2250000
unkown
page readonly
 clean
2235000
heap private
page read and write
 clean
2959000
unkown
page readonly
 clean
21D0000
heap private
page read and write
 clean
2BA0000
unkown
page readonly
 clean
2BE000
unkown
page read and write
 clean
1BC0000
unkown
page readonly
 clean
28C5000
unkown
page readonly
 clean
60000
unkown
page readonly
 clean
2DB0000
unkown
page readonly
 clean
2936000
unkown
page readonly
 clean
2922000
unkown
page readonly
 clean
200000
heap private
page read and write
 clean
28A6000
unkown
page readonly
 clean
2925000
unkown
page readonly
 clean
A3F000
unkown
page read and write
 clean
28F9000
unkown
page readonly
 clean
2975000
unkown
page readonly
 clean
2652000
unkown
page readonly
 clean
580000
unkown
page readonly
 clean
27F2000
unkown
page readonly
 clean
2959000
unkown
page readonly
 clean
2AE2000
unkown
page readonly
 clean
2882000
unkown
page readonly
 clean
2239000
heap private
page read and write
 clean
28DD000
unkown
page readonly
 clean
2D0000
unkown
page read and write
 clean
28C5000
unkown
page readonly
 clean
2945000
unkown
page readonly
 clean
100000
unkown
page readonly
 clean
13C000
unkown
page read and write
 clean
2D6B000
heap private
page read and write
 clean
26F2000
unkown
page readonly
 clean
25F8000
unkown
page readonly
 clean
260000
unkown
page readonly
 clean
510000
unkown
page readonly
 clean
2834000
unkown
page readonly
 clean
494000
heap private
page read and write
 clean
28D9000
unkown
page readonly
 clean
29B2000
unkown
page readonly
 clean
22B0000
unkown
page readonly
 clean
20A0000
heap private
page read and write
 clean
2C60000
unkown
page readonly
 clean
2906000
unkown
page readonly
 clean
D0000
unkown
page read and write
 clean
4A0000
unkown
page readonly
 clean
28B2000
unkown
page readonly
 clean
27D2000
unkown
page readonly
 clean
2895000
unkown
page readonly
 clean
410000
heap default
page read and write
 clean
2912000
unkown
page readonly
 clean
2846000
unkown
page readonly
 clean
2939000
unkown
page readonly
 clean
2952000
unkown
page readonly
 clean
2929000
unkown
page readonly
 clean
26B000
unkown
page read and write
 clean
2B80000
unkown
page readonly
 clean
60000
unkown
page read and write
 clean
29B9000
unkown
page readonly
 clean
25F2000
unkown
page readonly
 clean
19E000
heap default
page read and write
 clean
2B42000
unkown
page readonly
 clean
1E17000
unkown
page readonly
 clean
There are 136 hidden memdumps, click here to show them.