IOCReport

loading gif

Files

File Path
Type
Category
Malicious
statistic-2067311372.xlsm
Microsoft Excel 2007+
initial sample
 malicious
C:\Users\user\Desktop\~$statistic-2067311372.xlsm
data
dropped
 malicious
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
Microsoft Cabinet archive data, 58596 bytes, 1 file
dropped
 clean
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A
data
dropped
 clean
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
data
dropped
 clean
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A
data
dropped
 clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\suspendedpage[1].htm
HTML document, ASCII text
downloaded
 clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\48501294.png
PNG image data, 205 x 58, 8-bit/color RGB, non-interlaced
dropped
 clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\63EBE985.png
PNG image data, 485 x 185, 8-bit/color RGB, non-interlaced
dropped
 clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\C6DA5ADB.png
PNG image data, 24 x 24, 8-bit/color RGB, non-interlaced
dropped
 clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\E002D9C2.png
PNG image data, 24 x 24, 8-bit/color RGB, non-interlaced
dropped
 clean
C:\Users\user\AppData\Local\Temp\CFDE0000
data
dropped
 clean
C:\Users\user\AppData\Local\Temp\CabEA41.tmp
Microsoft Cabinet archive data, 58596 bytes, 1 file
dropped
 clean
C:\Users\user\AppData\Local\Temp\TarEA42.tmp
data
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Tue Oct 17 10:04:00 2017, mtime=Tue May 4 19:49:42 2021, atime=Tue May 4 19:49:42 2021, length=12288, window=hide
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
ASCII text, with CRLF line terminators
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\statistic-2067311372.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:15 2020, mtime=Tue May 4 19:49:42 2021, atime=Tue May 4 19:49:42 2021, length=109077, window=hide
dropped
 clean
C:\Users\user\Desktop\A0EE0000
data
dropped
 clean
C:\Users\user\jordji.nbvt11
HTML document, ASCII text
dropped
 clean
There are 9 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
 malicious
C:\Windows\System32\rundll32.exe
rundll32 ..\jordji.nbvt1,DllRegisterServer
 malicious
C:\Windows\System32\rundll32.exe
rundll32 ..\jordji.nbvt11,DllRegisterServer
 malicious

URLs

Name
IP
Malicious
http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
unknown
 clean
http://www.windows.com/pctv.
unknown
 clean
http://investor.msn.com
unknown
 clean
http://www.msnbc.com/news/ticker.txt
unknown
 clean
http://www.icra.org/vocabulary/.
unknown
 clean
http://windowsmedia.com/redir/services.asp?WMPFriendly=true
unknown
 clean
http://www.hotmail.com/oe
unknown
 clean
http://fwdssp.com/?dn=referer_detect&pid=5POL4F2O4
unknown
 clean
http://investor.msn.com/
unknown
 clean

Domains

Name
IP
Malicious
anaheimdermatologists.com
192.185.5.2
 clean
industrialarttextile.com
192.254.233.89
 clean

IPs

IP
Domain
Country
Malicious
192.185.5.2
anaheimdermatologists.com
United States
clean
192.254.233.89
industrialarttextile.com
United States
clean

Registry

Path
Value
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
em3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
MTTT
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ReviewToken
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ED9DB
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
VBAFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
DefaultSheetR2L
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
UseSystemSeparators
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ThousandsSeparator
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
DecimalSeparator
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EDD74
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EDEBB
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EDF67
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EE060
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EE13B
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
{E7E4BC40-E76A-11CE-A9BB-00AA004AE837} {000214E6-0000-0000-C000-000000000046} 0xFFFF
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ey3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\system32\qagentrt.dll,-10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\System32\fveui.dll,-843
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\System32\fveui.dll,-844
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\System32\wuaueng.dll,-400
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
LastPurgeTime
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
10510D
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
10601A
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EXCELFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SavedLegacySettings
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
There are 111 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
2AB9000
unkown
page readonly
 clean
20000
unkown
page readonly
 clean
27A2000
unkown
page readonly
 clean
1A0000
unkown
page write copy
 clean
29F5000
unkown
page readonly
 clean
2914000
unkown
page readonly
 clean
BD000
unkown
page read and write
 clean
2A36000
unkown
page readonly
 clean
21D0000
unkown
page read and write
 clean
4BF000
unkown
page read and write
 clean
680000
unkown
page readonly
 clean
21B000
heap default
page read and write
 clean
23B0000
unkown
page readonly
 clean
307000
heap default
page read and write
 clean
29D0000
unkown
page readonly
 clean
2852000
unkown
page readonly
 clean
1E07000
unkown
page readonly
 clean
190000
unkown
page readonly
 clean
61F000
unkown
page read and write
 clean
29C5000
unkown
page readonly
 clean
29A6000
unkown
page readonly
 clean
2BA0000
unkown
page readonly
 clean
2749000
unkown
page readonly
 clean
2DE5000
heap private
page read and write
 clean
2025000
heap private
page read and write
 clean
2685000
unkown
page readonly
 clean
2932000
unkown
page readonly
 clean
404000
heap private
page read and write
 clean
E0000
unkown
page readonly
 clean
450000
heap private
page read and write
 clean
2765000
unkown
page readonly
 clean
2990000
unkown
page readonly
 clean
2E1B000
heap private
page read and write
 clean
2AA5000
unkown
page readonly
 clean
2E70000
unkown
page read and write
 clean
400000
heap private
page read and write
 clean
2E60000
unkown
page readonly
 clean
2330000
heap private
page read and write
 clean
26E5000
unkown
page readonly
 clean
1D7000
heap default
page read and write
 clean
2642000
unkown
page readonly
 clean
2995000
unkown
page readonly
 clean
2A39000
unkown
page readonly
 clean
2442000
unkown
page readonly
 clean
306000
unkown
page read and write
 clean
29D6000
unkown
page readonly
 clean
2D0000
unkown
page read and write
 clean
460000
unkown
page read and write
 clean
A5F000
unkown
page read and write
 clean
70000
unkown
page read and write
 clean
2150000
heap private
page read and write
 clean
1C20000
unkown
page readonly
 clean
400000
unkown
page read and write
 clean
D0000
unkown
page read and write
 clean
2624000
unkown
page readonly
 clean
2A3D000
unkown
page readonly
 clean
1C80000
unkown
page readonly
 clean
300000
heap default
page read and write
 clean
2742000
unkown
page readonly
 clean
2C80000
unkown
page readonly
 clean
27C5000
unkown
page readonly
 clean
2752000
unkown
page readonly
 clean
26D2000
unkown
page readonly
 clean
2AD5000
unkown
page readonly
 clean
2982000
unkown
page readonly
 clean
2A52000
unkown
page readonly
 clean
29B2000
unkown
page readonly
 clean
26A2000
unkown
page readonly
 clean
230000
unkown
page write copy
 clean
360000
unkown
page readonly
 clean
130000
unkown
page readonly
 clean
2CA0000
unkown
page readonly
 clean
2A82000
unkown
page readonly
 clean
2779000
unkown
page readonly
 clean
2672000
unkown
page readonly
 clean
2DE0000
heap private
page read and write
 clean
2772000
unkown
page readonly
 clean
F0000
heap private
page read and write
 clean
2952000
unkown
page readonly
 clean
29B0000
unkown
page readonly
 clean
12B000
unkown
page read and write
 clean
2622000
unkown
page readonly
 clean
267000
heap default
page read and write
 clean
2912000
unkown
page readonly
 clean
60000
unkown
page readonly
 clean
2644000
unkown
page readonly
 clean
272D000
unkown
page readonly
 clean
2729000
unkown
page readonly
 clean
2954000
unkown
page readonly
 clean
2A06000
unkown
page readonly
 clean
496000
unkown
page read and write
 clean
29E000
heap default
page read and write
 clean
22B000
unkown
page read and write
 clean
29E2000
unkown
page readonly
 clean
23D0000
unkown
page readonly
 clean
2A59000
unkown
page readonly
 clean
2795000
unkown
page readonly
 clean
6C0000
unkown
page readonly
 clean
2AB2000
unkown
page readonly
 clean
2CC0000
unkown
page readonly
 clean
2020000
heap private
page read and write
 clean
26F6000
unkown
page readonly
 clean
20000
unkown
page readonly
 clean
2B25000
heap private
page read and write
 clean
1E67000
unkown
page readonly
 clean
26C6000
unkown
page readonly
 clean
2715000
unkown
page readonly
 clean
20C0000
unkown
page readonly
 clean
26B5000
unkown
page readonly
 clean
20A0000
unkown
page readonly
 clean
2702000
unkown
page readonly
 clean
1D0000
heap default
page read and write
 clean
110000
heap private
page read and write
 clean
27A9000
unkown
page readonly
 clean
2542000
unkown
page readonly
 clean
2A89000
unkown
page readonly
 clean
2A12000
unkown
page readonly
 clean
F4000
heap private
page read and write
 clean
2934000
unkown
page readonly
 clean
2B5B000
heap private
page read and write
 clean
2758000
unkown
page readonly
 clean
33E000
heap default
page read and write
 clean
2970000
unkown
page readonly
 clean
454000
heap private
page read and write
 clean
20D000
heap default
page read and write
 clean
2696000
unkown
page readonly
 clean
2932000
unkown
page readonly
 clean
2B20000
heap private
page read and write
 clean
E0000
unkown
page read and write
 clean
260000
heap default
page read and write
 clean
6E0000
unkown
page readonly
 clean
60000
unkown
page read and write
 clean
2448000
unkown
page readonly
 clean
2604000
unkown
page readonly
 clean
216000
heap default
page read and write
 clean
2029000
heap private
page read and write
 clean
436000
unkown
page read and write
 clean
2339000
heap private
page read and write
 clean
2335000
heap private
page read and write
 clean
560000
unkown
page readonly
 clean
2C42000
unkown
page readonly
 clean
500000
unkown
page readonly
 clean
2A75000
unkown
page readonly
 clean
2602000
unkown
page readonly
 clean
2A25000
unkown
page readonly
 clean
2726000
unkown
page readonly
 clean
There are 136 hidden memdumps, click here to show them.