IOCReport

loading gif

Files

File Path
Type
Category
Malicious
32154f4c_by_Libranalysis.xls
Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1251, Author: van-van, Last Saved By: vi-vi, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Wed May 12 08:24:11 2021, Security: 0
initial sample
 malicious
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
Microsoft Cabinet archive data, 59863 bytes, 1 file
dropped
 clean
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A
data
dropped
 clean
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
data
dropped
 clean
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A
data
dropped
 clean
C:\Users\user\AppData\Local\Temp\CabFE6C.tmp
Microsoft Cabinet archive data, 59863 bytes, 1 file
dropped
 clean
C:\Users\user\AppData\Local\Temp\D3FE0000
data
dropped
 clean
C:\Users\user\AppData\Local\Temp\TarFE6D.tmp
data
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\32154f4c_by_Libranalysis.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed May 12 19:35:28 2021, mtime=Wed May 12 19:35:47 2021, atime=Wed May 12 19:35:48 2021, length=174080, window=hide
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Tue Oct 17 10:04:00 2017, mtime=Wed May 12 19:35:47 2021, atime=Wed May 12 19:35:47 2021, length=8192, window=hide
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
ASCII text, with CRLF line terminators
dropped
 clean
C:\Users\user\Desktop\05FE0000
Applesoft BASIC program data, first line number 16
dropped
 clean
There are 2 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
 malicious
C:\Windows\System32\rundll32.exe
rundll32 ..\ritofm.cvm,DllRegisterServer
 malicious
C:\Windows\System32\rundll32.exe
rundll32 ..\ritofm.cvm1,DllRegisterServer
 malicious

URLs

Name
IP
Malicious
http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
unknown
 clean
http://www.windows.com/pctv.
unknown
 clean
http://investor.msn.com
unknown
 clean
http://www.msnbc.com/news/ticker.txt
unknown
 clean
http://www.icra.org/vocabulary/.
unknown
 clean
http://windowsmedia.com/redir/services.asp?WMPFriendly=true
unknown
 clean
http://www.hotmail.com/oe
unknown
 clean
http://investor.msn.com/
unknown
 clean

Domains

Name
IP
Malicious
signifysystem.com
192.185.39.58
 clean
fcventasyservicios.cl
192.185.32.232
 clean

IPs

IP
Domain
Country
Malicious
192.185.39.58
signifysystem.com
United States
clean
192.185.32.232
fcventasyservicios.cl
United States
clean

Registry

Path
Value
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
9g3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
MTTT
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ReviewToken
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EEED2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
VBAFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
DefaultSheetR2L
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
UseSystemSeparators
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ThousandsSeparator
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
DecimalSeparator
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EF1ED
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EF2E7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EF344
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EF4AB
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EF5D4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
{E7E4BC40-E76A-11CE-A9BB-00AA004AE837} {000214E6-0000-0000-C000-000000000046} 0xFFFF
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
or3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\system32\qagentrt.dll,-10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\System32\fveui.dll,-843
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\System32\fveui.dll,-844
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\System32\wuaueng.dll,-400
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
LastPurgeTime
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
11A91B
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
11B5F7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EXCELFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SavedLegacySettings
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
There are 111 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
2726000
unkown
page readonly
 clean
200000
heap private
page read and write
 clean
1EF0000
unkown
page write copy
 clean
2865000
unkown
page readonly
 clean
160000
heap default
page read and write
 clean
2AF0000
unkown
page readonly
 clean
2E4000
heap private
page read and write
 clean
2AB2000
unkown
page readonly
 clean
3C4000
heap private
page read and write
 clean
2D20000
heap private
page read and write
 clean
260000
unkown
page read and write
 clean
3C0000
heap private
page read and write
 clean
2240000
unkown
page readonly
 clean
2782000
unkown
page readonly
 clean
2F0000
unkown
page read and write
 clean
2835000
unkown
page readonly
 clean
510000
unkown
page readonly
 clean
160000
unkown
page readonly
 clean
2089000
heap private
page read and write
 clean
2E0000
heap private
page read and write
 clean
21A5000
heap private
page read and write
 clean
1C9000
heap default
page read and write
 clean
21A0000
heap private
page read and write
 clean
2C05000
heap private
page read and write
 clean
2F50000
unkown
page read and write
 clean
2762000
unkown
page readonly
 clean
27C2000
unkown
page readonly
 clean
2809000
unkown
page readonly
 clean
28C2000
unkown
page readonly
 clean
1A6000
heap default
page read and write
 clean
2825000
unkown
page readonly
 clean
127000
heap default
page read and write
 clean
2085000
heap private
page read and write
 clean
2D25000
heap private
page read and write
 clean
F0000
unkown
page read and write
 clean
20000
unkown
page readonly
 clean
26D2000
unkown
page readonly
 clean
390000
unkown
page readonly
 clean
2882000
unkown
page readonly
 clean
2775000
unkown
page readonly
 clean
1B10000
unkown
page readonly
 clean
204000
heap private
page read and write
 clean
2846000
unkown
page readonly
 clean
2915000
unkown
page readonly
 clean
25C2000
unkown
page readonly
 clean
326000
unkown
page read and write
 clean
1AB0000
unkown
page readonly
 clean
2876000
unkown
page readonly
 clean
27A4000
unkown
page readonly
 clean
2922000
unkown
page readonly
 clean
1C97000
unkown
page readonly
 clean
1D0000
unkown
page read and write
 clean
27A9000
unkown
page readonly
 clean
2816000
unkown
page readonly
 clean
2220000
unkown
page readonly
 clean
2DA0000
unkown
page readonly
 clean
2C6000
unkown
page read and write
 clean
27F5000
unkown
page readonly
 clean
2B30000
unkown
page readonly
 clean
26E5000
unkown
page readonly
 clean
24A8000
unkown
page readonly
 clean
29F0000
unkown
page readonly
 clean
3F0000
unkown
page readonly
 clean
296000
unkown
page read and write
 clean
2895000
unkown
page readonly
 clean
2D5B000
heap private
page read and write
 clean
28F9000
unkown
page readonly
 clean
1E0000
unkown
page read and write
 clean
29D0000
unkown
page readonly
 clean
2805000
unkown
page readonly
 clean
1F50000
unkown
page readonly
 clean
E0000
unkown
page read and write
 clean
15E000
heap default
page read and write
 clean
26C2000
unkown
page readonly
 clean
20000
unkown
page readonly
 clean
26A2000
unkown
page readonly
 clean
2992000
unkown
page readonly
 clean
2C00000
heap private
page read and write
 clean
27F2000
unkown
page readonly
 clean
278D000
unkown
page readonly
 clean
220000
unkown
page readonly
 clean
25A2000
unkown
page readonly
 clean
2745000
unkown
page readonly
 clean
B3F000
unkown
page read and write
 clean
1CF7000
unkown
page readonly
 clean
2B10000
unkown
page readonly
 clean
2784000
unkown
page readonly
 clean
CC000
unkown
page read and write
 clean
2050000
heap private
page read and write
 clean
2702000
unkown
page readonly
 clean
290000
unkown
page read and write
 clean
2C3B000
heap private
page read and write
 clean
660000
unkown
page readonly
 clean
2080000
heap private
page read and write
 clean
27A2000
unkown
page readonly
 clean
25C8000
unkown
page readonly
 clean
2732000
unkown
page readonly
 clean
60000
unkown
page readonly
 clean
2C80000
unkown
page readonly
 clean
2A30000
unkown
page readonly
 clean
2100000
unkown
page readonly
 clean
5AE000
unkown
page read and write
 clean
26F6000
unkown
page readonly
 clean
24A2000
unkown
page readonly
 clean
2664000
unkown
page readonly
 clean
28C9000
unkown
page readonly
 clean
27C4000
unkown
page readonly
 clean
2802000
unkown
page readonly
 clean
2945000
unkown
page readonly
 clean
9AF000
unkown
page read and write
 clean
67000
heap default
page read and write
 clean
60000
heap default
page read and write
 clean
2B50000
unkown
page read and write
 clean
28E5000
unkown
page readonly
 clean
2A10000
unkown
page readonly
 clean
19D000
heap default
page read and write
 clean
28A6000
unkown
page readonly
 clean
9E000
heap default
page read and write
 clean
2822000
unkown
page readonly
 clean
1E90000
unkown
page write copy
 clean
120000
heap default
page read and write
 clean
28A9000
unkown
page readonly
 clean
570000
unkown
page readonly
 clean
27D9000
unkown
page readonly
 clean
28B000
unkown
page read and write
 clean
21A9000
heap private
page read and write
 clean
2715000
unkown
page readonly
 clean
27A2000
unkown
page readonly
 clean
2120000
unkown
page readonly
 clean
2662000
unkown
page readonly
 clean
2682000
unkown
page readonly
 clean
2789000
unkown
page readonly
 clean
14D000
unkown
page read and write
 clean
2684000
unkown
page readonly
 clean
27C5000
unkown
page readonly
 clean
2852000
unkown
page readonly
 clean
2929000
unkown
page readonly
 clean
167000
heap default
page read and write
 clean
28F2000
unkown
page readonly
 clean
26A4000
unkown
page readonly
 clean
2756000
unkown
page readonly
 clean
2786000
unkown
page readonly
 clean
1FB0000
heap private
page read and write
 clean
28AD000
unkown
page readonly
 clean
27D2000
unkown
page readonly
 clean
There are 135 hidden memdumps, click here to show them.