IOCReport

loading gif

Files

File Path
Type
Category
Malicious
statistic-2070252624.xlsm
Microsoft Excel 2007+
initial sample
 malicious
C:\Users\user\Desktop\~$statistic-2070252624.xlsm
data
dropped
 malicious
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
Microsoft Cabinet archive data, 58596 bytes, 1 file
dropped
 clean
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A
data
dropped
 clean
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
data
dropped
 clean
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A
data
dropped
 clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\suspendedpage[1].htm
HTML document, ASCII text
downloaded
 clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\8E426944.png
PNG image data, 485 x 185, 8-bit/color RGB, non-interlaced
dropped
 clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\E1EA088F.png
PNG image data, 205 x 58, 8-bit/color RGB, non-interlaced
dropped
 clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\EAA553F2.png
PNG image data, 24 x 24, 8-bit/color RGB, non-interlaced
dropped
 clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\F6F47075.png
PNG image data, 24 x 24, 8-bit/color RGB, non-interlaced
dropped
 clean
C:\Users\user\AppData\Local\Temp\CabE7FF.tmp
Microsoft Cabinet archive data, 58596 bytes, 1 file
dropped
 clean
C:\Users\user\AppData\Local\Temp\EDDE0000
data
dropped
 clean
C:\Users\user\AppData\Local\Temp\TarE800.tmp
data
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Tue Oct 17 10:04:00 2017, mtime=Tue May 4 19:40:42 2021, atime=Tue May 4 19:40:42 2021, length=8192, window=hide
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
ASCII text, with CRLF line terminators
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\statistic-2070252624.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:17 2020, mtime=Tue May 4 19:40:42 2021, atime=Tue May 4 19:40:42 2021, length=109076, window=hide
dropped
 clean
C:\Users\user\Desktop\BEDE0000
data
dropped
 clean
C:\Users\user\jordji.nbvt11
HTML document, ASCII text
dropped
 clean
There are 9 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
 malicious
C:\Windows\System32\rundll32.exe
rundll32 ..\jordji.nbvt1,DllRegisterServer
 malicious
C:\Windows\System32\rundll32.exe
rundll32 ..\jordji.nbvt11,DllRegisterServer
 malicious

URLs

Name
IP
Malicious
http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
unknown
 clean
http://www.windows.com/pctv.
unknown
 clean
http://investor.msn.com
unknown
 clean
http://www.msnbc.com/news/ticker.txt
unknown
 clean
http://www.icra.org/vocabulary/.
unknown
 clean
http://windowsmedia.com/redir/services.asp?WMPFriendly=true
unknown
 clean
http://www.hotmail.com/oe
unknown
 clean
http://fwdssp.com/?dn=referer_detect&pid=5POL4F2O4
unknown
 clean
http://investor.msn.com/
unknown
 clean

Domains

Name
IP
Malicious
anaheimdermatologists.com
192.185.5.2
 clean
industrialarttextile.com
192.254.233.89
 clean

IPs

IP
Domain
Country
Malicious
192.185.5.2
anaheimdermatologists.com
United States
clean
192.254.233.89
industrialarttextile.com
United States
clean

Registry

Path
Value
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
=,4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
MTTT
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ReviewToken
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ED8B3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
VBAFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
DefaultSheetR2L
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
UseSystemSeparators
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ThousandsSeparator
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
DecimalSeparator
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EDC2C
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EDCF7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EDD83
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EDE7D
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EDF28
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
{E7E4BC40-E76A-11CE-A9BB-00AA004AE837} {000214E6-0000-0000-C000-000000000046} 0xFFFF
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
$74
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\system32\qagentrt.dll,-10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\System32\fveui.dll,-843
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\System32\fveui.dll,-844
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\System32\wuaueng.dll,-400
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
LastPurgeTime
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
104BCF
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
105D6C
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EXCELFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SavedLegacySettings
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
There are 111 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
27E9000
unkown
page readonly
 clean
2785000
unkown
page readonly
 clean
2999000
unkown
page readonly
 clean
28B4000
unkown
page readonly
 clean
26B8000
unkown
page readonly
 clean
1CF7000
unkown
page readonly
 clean
2912000
unkown
page readonly
 clean
29B9000
unkown
page readonly
 clean
436000
unkown
page read and write
 clean
2874000
unkown
page readonly
 clean
150000
unkown
page read and write
 clean
570000
unkown
page readonly
 clean
2330000
unkown
page readonly
 clean
19D000
unkown
page read and write
 clean
24E2000
unkown
page readonly
 clean
2A19000
unkown
page readonly
 clean
2C00000
unkown
page readonly
 clean
2835000
unkown
page readonly
 clean
220000
heap private
page read and write
 clean
237000
heap default
page read and write
 clean
2B30000
unkown
page readonly
 clean
2D20000
unkown
page readonly
 clean
59E000
unkown
page read and write
 clean
224000
heap private
page read and write
 clean
50F000
unkown
page read and write
 clean
2A12000
unkown
page readonly
 clean
500000
unkown
page readonly
 clean
2A35000
unkown
page readonly
 clean
2A50000
unkown
page readonly
 clean
2812000
unkown
page readonly
 clean
2892000
unkown
page readonly
 clean
174000
heap private
page read and write
 clean
26B2000
unkown
page readonly
 clean
2A10000
unkown
page readonly
 clean
2865000
unkown
page readonly
 clean
27E2000
unkown
page readonly
 clean
2736000
unkown
page readonly
 clean
BB000
unkown
page read and write
 clean
28B2000
unkown
page readonly
 clean
29D5000
unkown
page readonly
 clean
26A4000
unkown
page readonly
 clean
160000
unkown
page read and write
 clean
2160000
unkown
page readonly
 clean
22E000
heap default
page read and write
 clean
330000
unkown
page read and write
 clean
27CD000
unkown
page readonly
 clean
230000
heap default
page read and write
 clean
2796000
unkown
page readonly
 clean
227000
heap default
page read and write
 clean
1F0000
heap default
page read and write
 clean
150000
unkown
page read and write
 clean
25E2000
unkown
page readonly
 clean
2966000
unkown
page readonly
 clean
20B0000
heap private
page read and write
 clean
2972000
unkown
page readonly
 clean
2140000
unkown
page readonly
 clean
2295000
heap private
page read and write
 clean
2872000
unkown
page readonly
 clean
2EE0000
unkown
page read and write
 clean
26C4000
unkown
page readonly
 clean
2772000
unkown
page readonly
 clean
299D000
unkown
page readonly
 clean
366000
unkown
page read and write
 clean
276000
heap default
page read and write
 clean
3F4000
heap private
page read and write
 clean
29B2000
unkown
page readonly
 clean
26A2000
unkown
page readonly
 clean
29D2000
unkown
page readonly
 clean
2985000
unkown
page readonly
 clean
2BA2000
unkown
page readonly
 clean
278000
heap default
page read and write
 clean
2AB0000
heap private
page read and write
 clean
1E07000
unkown
page readonly
 clean
2842000
unkown
page readonly
 clean
2FF0000
unkown
page read and write
 clean
CB000
unkown
page read and write
 clean
190000
unkown
page readonly
 clean
2C40000
unkown
page readonly
 clean
2849000
unkown
page readonly
 clean
2712000
unkown
page readonly
 clean
21C0000
heap private
page read and write
 clean
20C5000
heap private
page read and write
 clean
2766000
unkown
page readonly
 clean
2936000
unkown
page readonly
 clean
E0000
unkown
page readonly
 clean
2AB5000
heap private
page read and write
 clean
2A30000
unkown
page readonly
 clean
20000
unkown
page readonly
 clean
29E2000
unkown
page readonly
 clean
2AEB000
heap private
page read and write
 clean
2894000
unkown
page readonly
 clean
2299000
heap private
page read and write
 clean
220000
heap default
page read and write
 clean
E0000
unkown
page readonly
 clean
2925000
unkown
page readonly
 clean
2996000
unkown
page readonly
 clean
27B5000
unkown
page readonly
 clean
2A05000
unkown
page readonly
 clean
2942000
unkown
page readonly
 clean
28F5000
unkown
page readonly
 clean
1F80000
unkown
page write copy
 clean
400000
unkown
page read and write
 clean
27A2000
unkown
page readonly
 clean
2725000
unkown
page readonly
 clean
28E2000
unkown
page readonly
 clean
2742000
unkown
page readonly
 clean
280000
heap default
page read and write
 clean
21FB000
heap private
page read and write
 clean
170000
heap private
page read and write
 clean
B3F000
unkown
page read and write
 clean
2906000
unkown
page readonly
 clean
2290000
heap private
page read and write
 clean
1C20000
unkown
page readonly
 clean
2755000
unkown
page readonly
 clean
20000
unkown
page readonly
 clean
770000
unkown
page readonly
 clean
27C9000
unkown
page readonly
 clean
20C9000
heap private
page read and write
 clean
320000
unkown
page write copy
 clean
2C20000
unkown
page readonly
 clean
29E9000
unkown
page readonly
 clean
2310000
unkown
page readonly
 clean
2BE0000
unkown
page readonly
 clean
3F0000
heap private
page read and write
 clean
1F7000
heap default
page read and write
 clean
26E4000
unkown
page readonly
 clean
2C10000
unkown
page readonly
 clean
21C5000
heap private
page read and write
 clean
24E8000
unkown
page readonly
 clean
2F0000
unkown
page read and write
 clean
26D000
heap default
page read and write
 clean
160000
unkown
page read and write
 clean
2955000
unkown
page readonly
 clean
680000
unkown
page readonly
 clean
20C0000
heap private
page read and write
 clean
1B10000
unkown
page readonly
 clean
27C6000
unkown
page readonly
 clean
26C2000
unkown
page readonly
 clean
60000
unkown
page readonly
 clean
25E000
heap default
page read and write
 clean
26E2000
unkown
page readonly
 clean
2819000
unkown
page readonly
 clean
2805000
unkown
page readonly
 clean
27B2000
unkown
page readonly
 clean
326000
unkown
page read and write
 clean
3F0000
unkown
page readonly
 clean
1F00000
heap private
page read and write
 clean
There are 137 hidden memdumps, click here to show them.