Files
File Path
|
Type
|
Category
|
Malicious
|
|
---|---|---|---|---|
Outstanding-Debt-610716193-05042021.xlsm
|
Microsoft Excel 2007+
|
initial sample
|
||
C:\Users\user\Desktop\~$Outstanding-Debt-610716193-05042021.xlsm
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\F49323B.jpg
|
[TIFF image data, big-endian, direntries=5], baseline, precision 8, 1080x1080, frames 3
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\B9DE0000
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\VBE\MSForms.exd
|
data
|
dropped
|
||
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Tue
Oct 17 10:04:00 2017, mtime=Wed May 5 01:13:41 2021, atime=Wed May 5 01:13:41 2021, length=8192, window=hide
|
dropped
|
||
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Outstanding-Debt-610716193-05042021.LNK
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:14
2020, mtime=Wed May 5 01:13:41 2021, atime=Wed May 5 01:13:41 2021, length=120427, window=hide
|
dropped
|
||
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
|
ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Users\user\Desktop\8ADE0000
|
data
|
dropped
|
Processes
Path
|
Cmdline
|
Malicious
|
|
---|---|---|---|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
|
URLs
Name
|
IP
|
Malicious
|
|
---|---|---|---|
http://51.89.73.159/44313,6048108796.dat
|
51.89.73.159
|
||
http://185.183.99.115/44313,6048108796.dat
|
185.183.99.115
|
||
http://190.14.37.38/44313,6048108796.dat
|
190.14.37.38
|
IPs
IP
|
Domain
|
Country
|
Malicious
|
|
---|---|---|---|---|
185.183.99.115
|
unknown
|
Netherlands
|
||
51.89.73.159
|
unknown
|
France
|
||
190.14.37.38
|
unknown
|
Panama
|
Registry
Path
|
Value
|
Malicious
|
|
---|---|---|---|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
>46
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
MTTT
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
VBAFiles
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
ReviewToken
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
ED346
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
DefaultSheetR2L
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
UseSystemSeparators
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
ThousandsSeparator
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
DecimalSeparator
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Max Display
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Max Display
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 1
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 2
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 3
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 4
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 5
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 6
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 7
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 8
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 9
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 10
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 11
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 12
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 13
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 14
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 15
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 16
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 17
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 18
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 19
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 20
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
ED76B
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
ED8A3
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
ED95E
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Max Display
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Max Display
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 1
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 2
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 3
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 4
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 5
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 6
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 7
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 8
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 9
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 10
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 11
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 12
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 13
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 14
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 15
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 16
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 17
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 18
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 19
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
Item 20
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
EDA39
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
EDAF4
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
{E7E4BC40-E76A-11CE-A9BB-00AA004AE837} {000214E6-0000-0000-C000-000000000046} 0xFFFF
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
.g6
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
LastPurgeTime
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
1033
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
1033
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
EXCELFiles
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
ProductFiles
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
NULL
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_3082
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_3082
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_1036
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_1036
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_1033
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_1033
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_3082
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_3082
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_1036
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_1036
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_1033
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SpellingAndGrammarFiles_1033
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
ProductFiles
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
ProductFiles
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
ProductFiles
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
ProductFiles
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
SavedLegacySettings
|
There are 209 hidden registries, click here to show them.