IOCReport

loading gif

Files

File Path
Type
Category
Malicious
statistic-2072807337.xlsm
Microsoft Excel 2007+
initial sample
 malicious
C:\Users\user\Desktop\~$statistic-2072807337.xlsm
data
dropped
 malicious
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
Microsoft Cabinet archive data, 58596 bytes, 1 file
dropped
 clean
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A
data
dropped
 clean
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
data
dropped
 clean
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A
data
dropped
 clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\suspendedpage[1].htm
HTML document, ASCII text
downloaded
 clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\11D9B08A.png
PNG image data, 24 x 24, 8-bit/color RGB, non-interlaced
dropped
 clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\3D04E4C7.png
PNG image data, 205 x 58, 8-bit/color RGB, non-interlaced
dropped
 clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\63D5E81C.png
PNG image data, 485 x 185, 8-bit/color RGB, non-interlaced
dropped
 clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\F713F16D.png
PNG image data, 24 x 24, 8-bit/color RGB, non-interlaced
dropped
 clean
C:\Users\user\AppData\Local\Temp\15EE0000
data
dropped
 clean
C:\Users\user\AppData\Local\Temp\CabEFDC.tmp
Microsoft Cabinet archive data, 58596 bytes, 1 file
dropped
 clean
C:\Users\user\AppData\Local\Temp\TarEFDD.tmp
data
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Tue Oct 17 10:04:00 2017, mtime=Tue May 4 19:26:44 2021, atime=Tue May 4 19:26:44 2021, length=8192, window=hide
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
ASCII text, with CRLF line terminators
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\statistic-2072807337.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:18 2020, mtime=Tue May 4 19:26:44 2021, atime=Tue May 4 19:26:44 2021, length=109076, window=hide
dropped
 clean
C:\Users\user\Desktop\D5EE0000
data
dropped
 clean
C:\Users\user\jordji.nbvt11
HTML document, ASCII text
dropped
 clean
There are 9 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
 malicious
C:\Windows\System32\rundll32.exe
rundll32 ..\jordji.nbvt1,DllRegisterServer
 malicious
C:\Windows\System32\rundll32.exe
rundll32 ..\jordji.nbvt11,DllRegisterServer
 malicious

URLs

Name
IP
Malicious
http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
unknown
 clean
http://www.windows.com/pctv.
unknown
 clean
http://investor.msn.com
unknown
 clean
http://www.msnbc.com/news/ticker.txt
unknown
 clean
http://www.icra.org/vocabulary/.
unknown
 clean
http://windowsmedia.com/redir/services.asp?WMPFriendly=true
unknown
 clean
http://www.hotmail.com/oe
unknown
 clean
http://fwdssp.com/?dn=referer_detect&pid=5POL4F2O4
unknown
 clean
http://investor.msn.com/
unknown
 clean

Domains

Name
IP
Malicious
anaheimdermatologists.com
192.185.5.2
 clean
industrialarttextile.com
192.254.233.89
 clean

IPs

IP
Domain
Country
Malicious
192.185.5.2
anaheimdermatologists.com
United States
clean
192.254.233.89
industrialarttextile.com
United States
clean

Registry

Path
Value
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
2s3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
MTTT
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ReviewToken
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EDEDA
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
VBAFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
DefaultSheetR2L
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
UseSystemSeparators
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ThousandsSeparator
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
DecimalSeparator
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EE2C1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EE3CA
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EE4A4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EE58E
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EE64A
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
{E7E4BC40-E76A-11CE-A9BB-00AA004AE837} {000214E6-0000-0000-C000-000000000046} 0xFFFF
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
e~3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\system32\qagentrt.dll,-10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\System32\fveui.dll,-843
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\System32\fveui.dll,-844
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\System32\wuaueng.dll,-400
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
LastPurgeTime
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
106D05
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
107A1F
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EXCELFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SavedLegacySettings
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
There are 111 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
300000
unkown
page read and write
 clean
27A5000
unkown
page readonly
 clean
29F2000
unkown
page readonly
 clean
2789000
unkown
page readonly
 clean
2742000
unkown
page readonly
 clean
29B6000
unkown
page readonly
 clean
2644000
unkown
page readonly
 clean
2A05000
unkown
page readonly
 clean
D0000
unkown
page read and write
 clean
29F0000
unkown
page readonly
 clean
2766000
unkown
page readonly
 clean
E0000
unkown
page read and write
 clean
394000
heap private
page read and write
 clean
2070000
unkown
page write copy
 clean
1FF0000
heap private
page read and write
 clean
2AF0000
heap private
page read and write
 clean
26B2000
unkown
page readonly
 clean
2A32000
unkown
page readonly
 clean
2AB5000
unkown
page readonly
 clean
190000
heap default
page read and write
 clean
17D000
heap default
page read and write
 clean
28F2000
unkown
page readonly
 clean
1C0000
unkown
page read and write
 clean
2482000
unkown
page readonly
 clean
ED000
unkown
page read and write
 clean
29E6000
unkown
page readonly
 clean
2662000
unkown
page readonly
 clean
72F000
unkown
page read and write
 clean
29C2000
unkown
page readonly
 clean
2A55000
unkown
page readonly
 clean
2738000
unkown
page readonly
 clean
2805000
unkown
page readonly
 clean
2912000
unkown
page readonly
 clean
2F90000
unkown
page read and write
 clean
1B20000
unkown
page readonly
 clean
2CA0000
unkown
page readonly
 clean
2D7000
heap default
page read and write
 clean
27E2000
unkown
page readonly
 clean
20000
unkown
page readonly
 clean
1F6000
unkown
page read and write
 clean
2736000
unkown
page readonly
 clean
2310000
heap private
page read and write
 clean
29D0000
unkown
page readonly
 clean
30E000
heap default
page read and write
 clean
20000
unkown
page readonly
 clean
3D0000
unkown
page readonly
 clean
140000
heap default
page read and write
 clean
2A69000
unkown
page readonly
 clean
27D5000
unkown
page readonly
 clean
2A99000
unkown
page readonly
 clean
2682000
unkown
page readonly
 clean
3D6000
unkown
page read and write
 clean
2A62000
unkown
page readonly
 clean
228B000
heap private
page read and write
 clean
186000
heap default
page read and write
 clean
2992000
unkown
page readonly
 clean
90000
unkown
page readonly
 clean
70000
unkown
page read and write
 clean
2100000
unkown
page readonly
 clean
3A0000
unkown
page read and write
 clean
2A16000
unkown
page readonly
 clean
2684000
unkown
page readonly
 clean
2914000
unkown
page readonly
 clean
2D0000
heap default
page read and write
 clean
120000
unkown
page readonly
 clean
2CC0000
unkown
page readonly
 clean
2255000
heap private
page read and write
 clean
2972000
unkown
page readonly
 clean
2A10000
unkown
page readonly
 clean
2C22000
unkown
page readonly
 clean
2732000
unkown
page readonly
 clean
2B70000
unkown
page readonly
 clean
27E9000
unkown
page readonly
 clean
1DA7000
unkown
page readonly
 clean
27B2000
unkown
page readonly
 clean
188000
heap default
page read and write
 clean
1BC0000
unkown
page readonly
 clean
11B000
unkown
page read and write
 clean
26F5000
unkown
page readonly
 clean
1BB000
unkown
page read and write
 clean
2932000
unkown
page readonly
 clean
2130000
unkown
page readonly
 clean
2C80000
unkown
page readonly
 clean
56E000
unkown
page read and write
 clean
494000
heap private
page read and write
 clean
620000
unkown
page readonly
 clean
390000
heap private
page read and write
 clean
276D000
unkown
page readonly
 clean
2755000
unkown
page readonly
 clean
2A19000
unkown
page readonly
 clean
147000
heap default
page read and write
 clean
2934000
unkown
page readonly
 clean
2069000
heap private
page read and write
 clean
2782000
unkown
page readonly
 clean
2B2B000
heap private
page read and write
 clean
2A1D000
unkown
page readonly
 clean
2582000
unkown
page readonly
 clean
550000
unkown
page readonly
 clean
26D6000
unkown
page readonly
 clean
36F000
unkown
page read and write
 clean
2390000
unkown
page readonly
 clean
2319000
heap private
page read and write
 clean
2A39000
unkown
page readonly
 clean
2E40000
unkown
page read and write
 clean
2A92000
unkown
page readonly
 clean
60000
unkown
page read and write
 clean
1F10000
heap private
page read and write
 clean
2706000
unkown
page readonly
 clean
2060000
heap private
page read and write
 clean
23E000
heap default
page read and write
 clean
28F4000
unkown
page readonly
 clean
2664000
unkown
page readonly
 clean
27B9000
unkown
page readonly
 clean
60000
unkown
page readonly
 clean
2962000
unkown
page readonly
 clean
BCF000
unkown
page read and write
 clean
20E0000
unkown
page readonly
 clean
1F90000
unkown
page write copy
 clean
2315000
heap private
page read and write
 clean
2C60000
unkown
page readonly
 clean
2AF5000
heap private
page read and write
 clean
2250000
heap private
page read and write
 clean
584000
heap private
page read and write
 clean
2065000
heap private
page read and write
 clean
29D5000
unkown
page readonly
 clean
29B0000
unkown
page readonly
 clean
2A85000
unkown
page readonly
 clean
1D07000
unkown
page readonly
 clean
2725000
unkown
page readonly
 clean
240000
unkown
page readonly
 clean
2488000
unkown
page readonly
 clean
580000
heap private
page read and write
 clean
2642000
unkown
page readonly
 clean
200000
heap default
page read and write
 clean
730000
unkown
page readonly
 clean
23B0000
unkown
page readonly
 clean
336000
unkown
page read and write
 clean
26C5000
unkown
page readonly
 clean
2712000
unkown
page readonly
 clean
2986000
unkown
page readonly
 clean
207000
heap default
page read and write
 clean
2832000
unkown
page readonly
 clean
490000
heap private
page read and write
 clean
26E2000
unkown
page readonly
 clean
4A0000
unkown
page readonly
 clean
29A5000
unkown
page readonly
 clean
2769000
unkown
page readonly
 clean
2975000
unkown
page readonly
 clean
There are 138 hidden memdumps, click here to show them.