IOCReport

loading gif

Files

File Path
Type
Category
Malicious
statistic-2069354685.xlsm
Microsoft Excel 2007+
initial sample
malicious
C:\Users\user\Desktop\~$statistic-2069354685.xlsm
data
dropped
malicious
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
Microsoft Cabinet archive data, 58596 bytes, 1 file
dropped
clean
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A
data
dropped
clean
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
data
dropped
clean
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A
data
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\suspendedpage[1].htm
HTML document, ASCII text
downloaded
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\216A9434.png
PNG image data, 205 x 58, 8-bit/color RGB, non-interlaced
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\7417EC62.png
PNG image data, 24 x 24, 8-bit/color RGB, non-interlaced
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\82F80CFB.png
PNG image data, 24 x 24, 8-bit/color RGB, non-interlaced
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\A28A3EA5.png
PNG image data, 485 x 185, 8-bit/color RGB, non-interlaced
dropped
clean
C:\Users\user\AppData\Local\Temp\0CDE0000
data
dropped
clean
C:\Users\user\AppData\Local\Temp\CabE725.tmp
Microsoft Cabinet archive data, 58596 bytes, 1 file
dropped
clean
C:\Users\user\AppData\Local\Temp\TarE726.tmp
data
dropped
clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Tue Oct 17 10:04:00 2017, mtime=Tue May 4 19:44:41 2021, atime=Tue May 4 19:44:41 2021, length=8192, window=hide
dropped
clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
ASCII text, with CRLF line terminators
dropped
clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\statistic-2069354685.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:16 2020, mtime=Tue May 4 19:44:41 2021, atime=Tue May 4 19:44:41 2021, length=109076, window=hide
dropped
clean
C:\Users\user\Desktop\0DDE0000
data
dropped
clean
C:\Users\user\jordji.nbvt11
HTML document, ASCII text
dropped
clean
There are 9 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
malicious
C:\Windows\System32\rundll32.exe
rundll32 ..\jordji.nbvt1,DllRegisterServer
malicious
C:\Windows\System32\rundll32.exe
rundll32 ..\jordji.nbvt11,DllRegisterServer
malicious

URLs

Name
IP
Malicious
http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
unknown
clean
http://www.windows.com/pctv.
unknown
clean
http://investor.msn.com
unknown
clean
http://www.msnbc.com/news/ticker.txt
unknown
clean
http://www.icra.org/vocabulary/.
unknown
clean
http://windowsmedia.com/redir/services.asp?WMPFriendly=true
unknown
clean
http://www.hotmail.com/oe
unknown
clean
http://fwdssp.com/?dn=referer_detect&pid=5POL4F2O4
unknown
clean
http://investor.msn.com/
unknown
clean

Domains

Name
IP
Malicious
anaheimdermatologists.com
192.185.5.2
clean
industrialarttextile.com
192.254.233.89
clean

IPs

IP
Domain
Country
Malicious
192.185.5.2
anaheimdermatologists.com
United States
clean
192.254.233.89
industrialarttextile.com
United States
clean

Registry

Path
Value
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
{&6
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
MTTT
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ReviewToken
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ED662
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
VBAFiles
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
DefaultSheetR2L
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
UseSystemSeparators
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ThousandsSeparator
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
DecimalSeparator
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EDA29
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EDB04
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EDBAF
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EDCB8
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EDD93
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
{E7E4BC40-E76A-11CE-A9BB-00AA004AE837} {000214E6-0000-0000-C000-000000000046} 0xFFFF
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
.26
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\system32\qagentrt.dll,-10
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\System32\fveui.dll,-843
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\System32\fveui.dll,-844
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\System32\wuaueng.dll,-400
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
LastPurgeTime
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
103727
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
104470
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1033
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1033
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EXCELFiles
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SavedLegacySettings
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
clean
There are 111 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
2949000
unkown
page readonly
clean
1DA7000
unkown
page readonly
clean
3E4000
heap private
page read and write
clean
40D000
heap default
page read and write
clean
2692000
unkown
page readonly
clean
C1F000
unkown
page read and write
clean
2B00000
unkown
page readonly
clean
2B40000
unkown
page readonly
clean
2270000
unkown
page readonly
clean
27D2000
unkown
page readonly
clean
2805000
unkown
page readonly
clean
60000
unkown
page readonly
clean
2A82000
unkown
page readonly
clean
2794000
unkown
page readonly
clean
28C6000
unkown
page readonly
clean
2846000
unkown
page readonly
clean
280000
unkown
page readonly
clean
2835000
unkown
page readonly
clean
140000
heap default
page read and write
clean
27F2000
unkown
page readonly
clean
1BC0000
unkown
page readonly
clean
2592000
unkown
page readonly
clean
390000
heap private
page read and write
clean
2210000
unkown
page readonly
clean
2CB0000
heap private
page read and write
clean
2816000
unkown
page readonly
clean
27E6000
unkown
page readonly
clean
2CB5000
heap private
page read and write
clean
28F9000
unkown
page readonly
clean
27F4000
unkown
page readonly
clean
2972000
unkown
page readonly
clean
28C9000
unkown
page readonly
clean
2792000
unkown
page readonly
clean
21F9000
heap private
page read and write
clean
2899000
unkown
page readonly
clean
2942000
unkown
page readonly
clean
750000
unkown
page readonly
clean
2179000
heap private
page read and write
clean
2B60000
unkown
page readonly
clean
27C2000
unkown
page readonly
clean
2598000
unkown
page readonly
clean
2AE0000
unkown
page readonly
clean
28F9000
unkown
page readonly
clean
4A0000
unkown
page readonly
clean
240000
unkown
page read and write
clean
20000
unkown
page readonly
clean
D0000
unkown
page read and write
clean
3D0000
heap default
page read and write
clean
287D000
unkown
page readonly
clean
2872000
unkown
page readonly
clean
147000
heap default
page read and write
clean
3A0000
unkown
page read and write
clean
44E000
heap default
page read and write
clean
17E000
heap default
page read and write
clean
1FA0000
unkown
page readonly
clean
2774000
unkown
page readonly
clean
26B000
unkown
page read and write
clean
2AC0000
unkown
page readonly
clean
2935000
unkown
page readonly
clean
2812000
unkown
page readonly
clean
410000
heap default
page read and write
clean
100000
heap private
page read and write
clean
2876000
unkown
page readonly
clean
2885000
unkown
page readonly
clean
2915000
unkown
page readonly
clean
2175000
heap private
page read and write
clean
BB000
unkown
page read and write
clean
2752000
unkown
page readonly
clean
2D80000
heap private
page read and write
clean
2814000
unkown
page readonly
clean
2B20000
unkown
page read and write
clean
28E5000
unkown
page readonly
clean
27D5000
unkown
page readonly
clean
6AE000
unkown
page read and write
clean
27D4000
unkown
page readonly
clean
2D30000
unkown
page readonly
clean
2170000
heap private
page read and write
clean
690000
unkown
page readonly
clean
41B000
heap default
page read and write
clean
2865000
unkown
page readonly
clean
F0000
unkown
page read and write
clean
2618000
unkown
page readonly
clean
2866000
unkown
page readonly
clean
2BA0000
unkown
page read and write
clean
2E00000
unkown
page readonly
clean
2CEB000
heap private
page read and write
clean
1E17000
unkown
page readonly
clean
394000
heap private
page read and write
clean
2B80000
unkown
page readonly
clean
2B0000
unkown
page write copy
clean
28D2000
unkown
page readonly
clean
60000
unkown
page readonly
clean
3E0000
heap private
page read and write
clean
2842000
unkown
page readonly
clean
2892000
unkown
page readonly
clean
1C30000
unkown
page readonly
clean
1D0000
unkown
page read and write
clean
2919000
unkown
page readonly
clean
2879000
unkown
page readonly
clean
28F2000
unkown
page readonly
clean
2290000
unkown
page readonly
clean
28A2000
unkown
page readonly
clean
2979000
unkown
page readonly
clean
290000
heap private
page read and write
clean
E0000
unkown
page read and write
clean
20A0000
heap private
page read and write
clean
2B02000
unkown
page readonly
clean
28E5000
unkown
page readonly
clean
2965000
unkown
page readonly
clean
28B5000
unkown
page readonly
clean
2855000
unkown
page readonly
clean
416000
heap default
page read and write
clean
19F000
unkown
page read and write
clean
21F5000
heap private
page read and write
clean
620000
unkown
page readonly
clean
510000
unkown
page readonly
clean
2D85000
heap private
page read and write
clean
21F0000
heap private
page read and write
clean
104000
heap private
page read and write
clean
2912000
unkown
page readonly
clean
417000
heap default
page read and write
clean
3D6000
unkown
page read and write
clean
2612000
unkown
page readonly
clean
240000
unkown
page readonly
clean
1E0000
unkown
page read and write
clean
2995000
unkown
page readonly
clean
2822000
unkown
page readonly
clean
28C2000
unkown
page readonly
clean
28B5000
unkown
page readonly
clean
20000
unkown
page readonly
clean
21F0000
unkown
page readonly
clean
2712000
unkown
page readonly
clean
23D000
unkown
page read and write
clean
276000
unkown
page read and write
clean
310000
unkown
page write copy
clean
27F2000
unkown
page readonly
clean
106000
unkown
page read and write
clean
2772000
unkown
page readonly
clean
2010000
unkown
page readonly
clean
3D7000
heap default
page read and write
clean
2852000
unkown
page readonly
clean
B8F000
unkown
page read and write
clean
2754000
unkown
page readonly
clean
28F6000
unkown
page readonly
clean
2DBB000
heap private
page read and write
clean
2896000
unkown
page readonly
clean
28FD000
unkown
page readonly
clean
There are 137 hidden memdumps, click here to show them.