IOCReport

loading gif

Files

File Path
Type
Category
Malicious
46747509_by_Libranalysis.xls
Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1251, Author: van-van, Last Saved By: vi-vi, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Wed May 12 08:24:11 2021, Security: 0
initial sample
 malicious
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
Microsoft Cabinet archive data, 59863 bytes, 1 file
dropped
 clean
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A
data
dropped
 clean
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
data
dropped
 clean
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A
data
dropped
 clean
C:\Users\user\AppData\Local\Temp\99DE0000
data
dropped
 clean
C:\Users\user\AppData\Local\Temp\CabE3CB.tmp
Microsoft Cabinet archive data, 59863 bytes, 1 file
dropped
 clean
C:\Users\user\AppData\Local\Temp\TarE3CC.tmp
data
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\46747509_by_Libranalysis.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed May 12 18:36:28 2021, mtime=Wed May 12 18:36:41 2021, atime=Wed May 12 18:36:41 2021, length=174080, window=hide
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Tue Oct 17 10:04:00 2017, mtime=Wed May 12 18:36:41 2021, atime=Wed May 12 18:36:41 2021, length=8192, window=hide
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
ASCII text, with CRLF line terminators
dropped
 clean
C:\Users\user\Desktop\6ADE0000
Applesoft BASIC program data, first line number 16
dropped
 clean
There are 2 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
 malicious
C:\Windows\System32\rundll32.exe
rundll32 ..\ritofm.cvm,DllRegisterServer
 malicious
C:\Windows\System32\rundll32.exe
rundll32 ..\ritofm.cvm1,DllRegisterServer
 malicious

URLs

Name
IP
Malicious
http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
unknown
 clean
http://www.windows.com/pctv.
unknown
 clean
http://investor.msn.com
unknown
 clean
http://www.msnbc.com/news/ticker.txt
unknown
 clean
http://www.icra.org/vocabulary/.
unknown
 clean
http://windowsmedia.com/redir/services.asp?WMPFriendly=true
unknown
 clean
http://www.hotmail.com/oe
unknown
 clean
http://investor.msn.com/
unknown
 clean

Domains

Name
IP
Malicious
signifysystem.com
192.185.39.58
 clean
fcventasyservicios.cl
192.185.32.232
 clean

IPs

IP
Domain
Country
Malicious
192.185.39.58
signifysystem.com
United States
clean
192.185.32.232
fcventasyservicios.cl
United States
clean

Registry

Path
Value
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|78
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
MTTT
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ReviewToken
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ED3F2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
VBAFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
DefaultSheetR2L
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
UseSystemSeparators
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ThousandsSeparator
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
DecimalSeparator
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ED7AA
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ED874
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ED901
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ED9FA
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EDB61
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
{E7E4BC40-E76A-11CE-A9BB-00AA004AE837} {000214E6-0000-0000-C000-000000000046} 0xFFFF
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
m#8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\system32\qagentrt.dll,-10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\System32\fveui.dll,-843
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\System32\fveui.dll,-844
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\System32\wuaueng.dll,-400
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
LastPurgeTime
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
113524
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1143C4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EXCELFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SavedLegacySettings
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
There are 111 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
70000
heap private
page read and write
 clean
2895000
unkown
page readonly
 clean
2CE5000
heap private
page read and write
 clean
21E0000
unkown
page readonly
 clean
2885000
unkown
page readonly
 clean
396000
unkown
page read and write
 clean
480000
unkown
page readonly
 clean
2846000
unkown
page readonly
 clean
2742000
unkown
page readonly
 clean
2D60000
unkown
page readonly
 clean
28C5000
unkown
page readonly
 clean
27B6000
unkown
page readonly
 clean
2952000
unkown
page readonly
 clean
1F60000
heap private
page read and write
 clean
2764000
unkown
page readonly
 clean
267000
heap default
page read and write
 clean
237000
heap default
page read and write
 clean
28B2000
unkown
page readonly
 clean
160000
unkown
page read and write
 clean
19B000
heap default
page read and write
 clean
1D37000
unkown
page readonly
 clean
60000
unkown
page readonly
 clean
2AB0000
unkown
page readonly
 clean
2925000
unkown
page readonly
 clean
430000
unkown
page readonly
 clean
1D87000
unkown
page readonly
 clean
2832000
unkown
page readonly
 clean
2869000
unkown
page readonly
 clean
20000
unkown
page readonly
 clean
1B50000
unkown
page readonly
 clean
2936000
unkown
page readonly
 clean
157000
heap default
page read and write
 clean
284D000
unkown
page readonly
 clean
2652000
unkown
page readonly
 clean
2C0000
unkown
page read and write
 clean
2852000
unkown
page readonly
 clean
2145000
heap private
page read and write
 clean
26E000
heap default
page read and write
 clean
22D0000
unkown
page readonly
 clean
2F6000
unkown
page read and write
 clean
2892000
unkown
page readonly
 clean
2AF0000
unkown
page readonly
 clean
2D1B000
heap private
page read and write
 clean
57E000
unkown
page read and write
 clean
BAF000
unkown
page read and write
 clean
2BD0000
unkown
page read and write
 clean
2662000
unkown
page readonly
 clean
150000
heap default
page read and write
 clean
22B0000
unkown
page readonly
 clean
250000
unkown
page readonly
 clean
2982000
unkown
page readonly
 clean
27A5000
unkown
page readonly
 clean
27F2000
unkown
page readonly
 clean
260000
heap default
page read and write
 clean
21C0000
unkown
page readonly
 clean
27D5000
unkown
page readonly
 clean
29A5000
unkown
page readonly
 clean
2835000
unkown
page readonly
 clean
2562000
unkown
page readonly
 clean
1BA0000
unkown
page readonly
 clean
28A6000
unkown
page readonly
 clean
29B9000
unkown
page readonly
 clean
2814000
unkown
page readonly
 clean
2906000
unkown
page readonly
 clean
1FA0000
heap private
page read and write
 clean
2939000
unkown
page readonly
 clean
2975000
unkown
page readonly
 clean
330000
unkown
page read and write
 clean
366000
unkown
page read and write
 clean
2149000
heap private
page read and write
 clean
2744000
unkown
page readonly
 clean
2568000
unkown
page readonly
 clean
1FE0000
unkown
page write copy
 clean
1D0000
heap private
page read and write
 clean
700000
unkown
page readonly
 clean
2AD0000
unkown
page readonly
 clean
28E5000
unkown
page readonly
 clean
2849000
unkown
page readonly
 clean
2E20000
unkown
page readonly
 clean
2BC0000
unkown
page readonly
 clean
2BE0000
unkown
page read and write
 clean
2854000
unkown
page readonly
 clean
2862000
unkown
page readonly
 clean
2B42000
unkown
page readonly
 clean
2230000
heap private
page read and write
 clean
29D5000
unkown
page readonly
 clean
196000
heap default
page read and write
 clean
20E0000
unkown
page readonly
 clean
28D6000
unkown
page readonly
 clean
600000
unkown
page readonly
 clean
5B0000
unkown
page readonly
 clean
2959000
unkown
page readonly
 clean
474000
heap private
page read and write
 clean
2235000
heap private
page read and write
 clean
2239000
heap private
page read and write
 clean
2A90000
unkown
page readonly
 clean
13D000
unkown
page read and write
 clean
360000
unkown
page read and write
 clean
29E000
heap default
page read and write
 clean
2912000
unkown
page readonly
 clean
2B80000
unkown
page readonly
 clean
28C9000
unkown
page readonly
 clean
1D4000
heap private
page read and write
 clean
2DA5000
heap private
page read and write
 clean
20000
unkown
page readonly
 clean
2792000
unkown
page readonly
 clean
18D000
heap default
page read and write
 clean
293D000
unkown
page readonly
 clean
470000
heap private
page read and write
 clean
2812000
unkown
page readonly
 clean
15C000
unkown
page read and write
 clean
D0000
unkown
page read and write
 clean
2752000
unkown
page readonly
 clean
28C2000
unkown
page readonly
 clean
27E6000
unkown
page readonly
 clean
2724000
unkown
page readonly
 clean
2722000
unkown
page readonly
 clean
2DA0000
heap private
page read and write
 clean
60000
unkown
page readonly
 clean
2658000
unkown
page readonly
 clean
2805000
unkown
page readonly
 clean
74000
heap private
page read and write
 clean
2DDB000
heap private
page read and write
 clean
28F5000
unkown
page readonly
 clean
2020000
unkown
page write copy
 clean
2CE0000
heap private
page read and write
 clean
29B2000
unkown
page readonly
 clean
2A52000
unkown
page readonly
 clean
E0000
unkown
page read and write
 clean
27C2000
unkown
page readonly
 clean
2822000
unkown
page readonly
 clean
2899000
unkown
page readonly
 clean
4EF000
unkown
page read and write
 clean
2834000
unkown
page readonly
 clean
1FC000
unkown
page read and write
 clean
2816000
unkown
page readonly
 clean
2BA0000
unkown
page readonly
 clean
2989000
unkown
page readonly
 clean
2140000
heap private
page read and write
 clean
28B5000
unkown
page readonly
 clean
2762000
unkown
page readonly
 clean
2882000
unkown
page readonly
 clean
230000
heap default
page read and write
 clean
D0000
unkown
page read and write
 clean
28E2000
unkown
page readonly
 clean
There are 135 hidden memdumps, click here to show them.