IOCReport

loading gif

Files

File Path
Type
Category
Malicious
9659e9a8_by_Libranalysis.xls
Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1251, Author: van-van, Last Saved By: vi-vi, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Wed May 12 08:24:11 2021, Security: 0
initial sample
 malicious
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
Microsoft Cabinet archive data, 59863 bytes, 1 file
dropped
 clean
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A
data
dropped
 clean
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
data
dropped
 clean
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A
data
dropped
 clean
C:\Users\user\AppData\Local\Temp\5AEE0000
data
dropped
 clean
C:\Users\user\AppData\Local\Temp\CabF4BC.tmp
Microsoft Cabinet archive data, 59863 bytes, 1 file
dropped
 clean
C:\Users\user\AppData\Local\Temp\TarF4BD.tmp
data
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\9659e9a8_by_Libranalysis.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed May 12 19:21:29 2021, mtime=Wed May 12 19:21:45 2021, atime=Wed May 12 19:21:45 2021, length=174080, window=hide
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Tue Oct 17 10:04:00 2017, mtime=Wed May 12 19:21:45 2021, atime=Wed May 12 19:21:45 2021, length=16384, window=hide
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
ASCII text, with CRLF line terminators
dropped
 clean
C:\Users\user\Desktop\5BEE0000
Applesoft BASIC program data, first line number 16
dropped
 clean
There are 2 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
 malicious
C:\Windows\System32\rundll32.exe
rundll32 ..\ritofm.cvm,DllRegisterServer
 malicious
C:\Windows\System32\rundll32.exe
rundll32 ..\ritofm.cvm1,DllRegisterServer
 malicious

URLs

Name
IP
Malicious
http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
unknown
 clean
http://www.windows.com/pctv.
unknown
 clean
http://investor.msn.com
unknown
 clean
http://www.msnbc.com/news/ticker.txt
unknown
 clean
http://www.icra.org/vocabulary/.
unknown
 clean
http://windowsmedia.com/redir/services.asp?WMPFriendly=true
unknown
 clean
http://www.hotmail.com/oe
unknown
 clean
http://investor.msn.com/
unknown
 clean

Domains

Name
IP
Malicious
signifysystem.com
192.185.39.58
 clean
fcventasyservicios.cl
192.185.32.232
 clean

IPs

IP
Domain
Country
Malicious
192.185.39.58
signifysystem.com
United States
clean
192.185.32.232
fcventasyservicios.cl
United States
clean

Registry

Path
Value
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ii8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
MTTT
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ReviewToken
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EE521
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
VBAFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
DefaultSheetR2L
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
UseSystemSeparators
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ThousandsSeparator
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
DecimalSeparator
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EE86C
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EE936
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EE9D2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EEAFB
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EEC23
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
{E7E4BC40-E76A-11CE-A9BB-00AA004AE837} {000214E6-0000-0000-C000-000000000046} 0xFFFF
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
>t8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\system32\qagentrt.dll,-10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\System32\fveui.dll,-843
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\System32\fveui.dll,-844
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\System32\wuaueng.dll,-400
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
LastPurgeTime
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
114F77
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
115CC0
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EXCELFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SavedLegacySettings
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
There are 111 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
3EE000
heap default
page read and write
 clean
2852000
unkown
page readonly
 clean
2989000
unkown
page readonly
 clean
184000
heap private
page read and write
 clean
2329000
heap private
page read and write
 clean
29F6000
unkown
page readonly
 clean
290D000
unkown
page readonly
 clean
2A02000
unkown
page readonly
 clean
2325000
heap private
page read and write
 clean
27E4000
unkown
page readonly
 clean
320000
heap private
page read and write
 clean
1BD0000
unkown
page readonly
 clean
2C70000
unkown
page readonly
 clean
2975000
unkown
page readonly
 clean
4B0000
unkown
page readonly
 clean
2C90000
unkown
page readonly
 clean
2A95000
unkown
page readonly
 clean
2CD0000
unkown
page readonly
 clean
2895000
unkown
page readonly
 clean
2CEB000
heap private
page read and write
 clean
2876000
unkown
page readonly
 clean
2D30000
unkown
page readonly
 clean
2A2D000
unkown
page readonly
 clean
E0000
unkown
page read and write
 clean
E0000
unkown
page read and write
 clean
2902000
unkown
page readonly
 clean
28C5000
unkown
page readonly
 clean
3B0000
heap default
page read and write
 clean
29A2000
unkown
page readonly
 clean
2DB0000
unkown
page readonly
 clean
2906000
unkown
page readonly
 clean
1FA0000
heap private
page read and write
 clean
2C32000
unkown
page readonly
 clean
2A42000
unkown
page readonly
 clean
28A6000
unkown
page readonly
 clean
2924000
unkown
page readonly
 clean
20000
unkown
page readonly
 clean
70F000
unkown
page read and write
 clean
2A26000
unkown
page readonly
 clean
20E0000
unkown
page readonly
 clean
1DB7000
unkown
page readonly
 clean
2209000
heap private
page read and write
 clean
2205000
heap private
page read and write
 clean
2985000
unkown
page readonly
 clean
2B70000
unkown
page readonly
 clean
338000
heap default
page read and write
 clean
2A29000
unkown
page readonly
 clean
2AA9000
unkown
page readonly
 clean
2CB0000
heap private
page read and write
 clean
29A5000
unkown
page readonly
 clean
880000
unkown
page readonly
 clean
2B90000
unkown
page readonly
 clean
3080000
unkown
page read and write
 clean
2882000
unkown
page readonly
 clean
2A79000
unkown
page readonly
 clean
2802000
unkown
page readonly
 clean
2CB5000
heap private
page read and write
 clean
2822000
unkown
page readonly
 clean
28F5000
unkown
page readonly
 clean
1CF7000
unkown
page readonly
 clean
180000
heap private
page read and write
 clean
22A0000
unkown
page readonly
 clean
2200000
heap private
page read and write
 clean
2922000
unkown
page readonly
 clean
29D2000
unkown
page readonly
 clean
2CF000
unkown
page read and write
 clean
2748000
unkown
page readonly
 clean
2824000
unkown
page readonly
 clean
2D0000
heap default
page read and write
 clean
60000
unkown
page readonly
 clean
2255000
heap private
page read and write
 clean
29C6000
unkown
page readonly
 clean
2942000
unkown
page readonly
 clean
60000
unkown
page readonly
 clean
28E2000
unkown
page readonly
 clean
210000
unkown
page read and write
 clean
20000
unkown
page readonly
 clean
3B7000
heap default
page read and write
 clean
570000
heap private
page read and write
 clean
3D0000
unkown
page read and write
 clean
59E000
unkown
page read and write
 clean
2722000
unkown
page readonly
 clean
2B12000
unkown
page readonly
 clean
2944000
unkown
page readonly
 clean
2040000
heap private
page read and write
 clean
2996000
unkown
page readonly
 clean
24D000
unkown
page read and write
 clean
316000
heap default
page read and write
 clean
2AC5000
unkown
page readonly
 clean
28B2000
unkown
page readonly
 clean
2742000
unkown
page readonly
 clean
2952000
unkown
page readonly
 clean
23A0000
unkown
page readonly
 clean
20B000
unkown
page read and write
 clean
2BB0000
unkown
page read and write
 clean
2250000
heap private
page read and write
 clean
2909000
unkown
page readonly
 clean
2320000
heap private
page read and write
 clean
20C0000
unkown
page write copy
 clean
630000
unkown
page readonly
 clean
18B000
unkown
page read and write
 clean
2865000
unkown
page readonly
 clean
2622000
unkown
page readonly
 clean
2A72000
unkown
page readonly
 clean
D0000
unkown
page read and write
 clean
2B0000
heap default
page read and write
 clean
2922000
unkown
page readonly
 clean
2EE000
heap default
page read and write
 clean
1B10000
unkown
page readonly
 clean
2945000
unkown
page readonly
 clean
2972000
unkown
page readonly
 clean
23C0000
unkown
page readonly
 clean
60000
unkown
page readonly
 clean
324000
heap private
page read and write
 clean
2B7000
heap default
page read and write
 clean
29B5000
unkown
page readonly
 clean
228B000
heap private
page read and write
 clean
2904000
unkown
page readonly
 clean
2D7000
heap default
page read and write
 clean
2A65000
unkown
page readonly
 clean
246000
unkown
page read and write
 clean
3B0000
unkown
page readonly
 clean
2959000
unkown
page readonly
 clean
406000
unkown
page read and write
 clean
2020000
unkown
page write copy
 clean
2628000
unkown
page readonly
 clean
2280000
unkown
page readonly
 clean
530000
unkown
page readonly
 clean
2CB0000
unkown
page readonly
 clean
30D000
heap default
page read and write
 clean
27E2000
unkown
page readonly
 clean
574000
heap private
page read and write
 clean
2A49000
unkown
page readonly
 clean
2A15000
unkown
page readonly
 clean
2982000
unkown
page readonly
 clean
29E5000
unkown
page readonly
 clean
2AA2000
unkown
page readonly
 clean
D0000
unkown
page read and write
 clean
66F000
unkown
page read and write
 clean
190000
unkown
page read and write
 clean
2804000
unkown
page readonly
 clean
1C6000
unkown
page read and write
 clean
28D6000
unkown
page readonly
 clean
2B50000
unkown
page readonly
 clean
2929000
unkown
page readonly
 clean
2842000
unkown
page readonly
 clean
There are 136 hidden memdumps, click here to show them.