IOCReport

loading gif

Files

File Path
Type
Category
Malicious
090811fa_by_Libranalysis.xls
Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1251, Author: van-van, Last Saved By: vi-vi, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Wed May 12 08:24:11 2021, Security: 0
initial sample
 malicious
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
Microsoft Cabinet archive data, 59863 bytes, 1 file
dropped
 clean
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A
data
dropped
 clean
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
data
dropped
 clean
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A
data
dropped
 clean
C:\Users\user\AppData\Local\Temp\6ADE0000
data
dropped
 clean
C:\Users\user\AppData\Local\Temp\CabE486.tmp
Microsoft Cabinet archive data, 59863 bytes, 1 file
dropped
 clean
C:\Users\user\AppData\Local\Temp\TarE487.tmp
data
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\090811fa_by_Libranalysis.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed May 12 22:48:28 2021, mtime=Wed May 12 22:48:41 2021, atime=Wed May 12 22:48:41 2021, length=174080, window=hide
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Tue Oct 17 10:04:00 2017, mtime=Wed May 12 22:48:41 2021, atime=Wed May 12 22:48:41 2021, length=16384, window=hide
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
ASCII text, with CRLF line terminators
dropped
 clean
C:\Users\user\Desktop\3BDE0000
Applesoft BASIC program data, first line number 16
dropped
 clean
There are 2 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
 malicious
C:\Windows\System32\rundll32.exe
rundll32 ..\ritofm.cvm,DllRegisterServer
 malicious
C:\Windows\System32\rundll32.exe
rundll32 ..\ritofm.cvm1,DllRegisterServer
 malicious

URLs

Name
IP
Malicious
http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
unknown
 clean
http://www.windows.com/pctv.
unknown
 clean
http://investor.msn.com
unknown
 clean
http://www.msnbc.com/news/ticker.txt
unknown
 clean
http://www.icra.org/vocabulary/.
unknown
 clean
http://windowsmedia.com/redir/services.asp?WMPFriendly=true
unknown
 clean
http://www.hotmail.com/oe
unknown
 clean
http://investor.msn.com/
unknown
 clean

Domains

Name
IP
Malicious
signifysystem.com
192.185.39.58
 clean
fcventasyservicios.cl
192.185.32.232
 clean

IPs

IP
Domain
Country
Malicious
192.185.39.58
signifysystem.com
United States
clean
192.185.32.232
fcventasyservicios.cl
United States
clean

Registry

Path
Value
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
o=8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
MTTT
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ReviewToken
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ED549
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
VBAFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
DefaultSheetR2L
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
UseSystemSeparators
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ThousandsSeparator
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
DecimalSeparator
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ED874
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ED930
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ED9FA
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EDAF4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EDBEE
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
{E7E4BC40-E76A-11CE-A9BB-00AA004AE837} {000214E6-0000-0000-C000-000000000046} 0xFFFF
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
)h8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\system32\qagentrt.dll,-10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\System32\fveui.dll,-843
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\System32\fveui.dll,-844
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\System32\wuaueng.dll,-400
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
LastPurgeTime
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
10E6D6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
10F70C
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EXCELFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SavedLegacySettings
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
There are 111 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
2935000
unkown
page readonly
 clean
140000
unkown
page readonly
 clean
20000
heap private
page read and write
 clean
1CD7000
unkown
page readonly
 clean
1AB0000
unkown
page readonly
 clean
456000
unkown
page read and write
 clean
2F70000
unkown
page read and write
 clean
2AA0000
unkown
page readonly
 clean
1C97000
unkown
page readonly
 clean
28E2000
unkown
page readonly
 clean
21F0000
unkown
page readonly
 clean
2859000
unkown
page readonly
 clean
510000
unkown
page readonly
 clean
2C25000
heap private
page read and write
 clean
2010000
heap private
page read and write
 clean
390000
unkown
page readonly
 clean
27C2000
unkown
page readonly
 clean
2812000
unkown
page readonly
 clean
27B5000
unkown
page readonly
 clean
264000
heap private
page read and write
 clean
285D000
unkown
page readonly
 clean
35D000
heap default
page read and write
 clean
2A62000
unkown
page readonly
 clean
2CA0000
unkown
page readonly
 clean
3C0000
heap private
page read and write
 clean
127000
heap default
page read and write
 clean
2159000
heap private
page read and write
 clean
2AC0000
unkown
page readonly
 clean
BAF000
unkown
page read and write
 clean
26E2000
unkown
page readonly
 clean
27D2000
unkown
page readonly
 clean
27E5000
unkown
page readonly
 clean
80000
unkown
page read and write
 clean
2836000
unkown
page readonly
 clean
21C9000
heap private
page read and write
 clean
70000
unkown
page read and write
 clean
13E000
heap default
page read and write
 clean
2825000
unkown
page readonly
 clean
2AE0000
unkown
page readonly
 clean
2C20000
heap private
page read and write
 clean
20000
unkown
page readonly
 clean
2260000
unkown
page readonly
 clean
2672000
unkown
page readonly
 clean
220000
unkown
page readonly
 clean
2885000
unkown
page readonly
 clean
21D0000
unkown
page readonly
 clean
36D000
heap default
page read and write
 clean
3D0000
unkown
page readonly
 clean
120000
heap default
page read and write
 clean
24000
heap private
page read and write
 clean
2855000
unkown
page readonly
 clean
2872000
unkown
page readonly
 clean
15E000
heap default
page read and write
 clean
2A6000
unkown
page read and write
 clean
2942000
unkown
page readonly
 clean
2B00000
unkown
page readonly
 clean
2772000
unkown
page readonly
 clean
2090000
heap private
page read and write
 clean
2872000
unkown
page readonly
 clean
28A9000
unkown
page readonly
 clean
2815000
unkown
page readonly
 clean
28C9000
unkown
page readonly
 clean
550000
unkown
page readonly
 clean
20CB000
heap private
page read and write
 clean
21C5000
heap private
page read and write
 clean
2774000
unkown
page readonly
 clean
2919000
unkown
page readonly
 clean
2155000
heap private
page read and write
 clean
27A2000
unkown
page readonly
 clean
1AF0000
unkown
page readonly
 clean
2826000
unkown
page readonly
 clean
320000
heap default
page read and write
 clean
27C6000
unkown
page readonly
 clean
200000
unkown
page readonly
 clean
107000
heap default
page read and write
 clean
2802000
unkown
page readonly
 clean
28A2000
unkown
page readonly
 clean
E0000
unkown
page read and write
 clean
2754000
unkown
page readonly
 clean
2B10000
unkown
page readonly
 clean
C3F000
unkown
page read and write
 clean
27E2000
unkown
page readonly
 clean
28E9000
unkown
page readonly
 clean
60000
unkown
page readonly
 clean
28A2000
unkown
page readonly
 clean
27A2000
unkown
page readonly
 clean
2856000
unkown
page readonly
 clean
28D2000
unkown
page readonly
 clean
420000
unkown
page read and write
 clean
2732000
unkown
page readonly
 clean
2C5B000
heap private
page read and write
 clean
1EF0000
heap private
page read and write
 clean
27E4000
unkown
page readonly
 clean
10B000
unkown
page read and write
 clean
327000
heap default
page read and write
 clean
27C4000
unkown
page readonly
 clean
260000
heap private
page read and write
 clean
21C0000
heap private
page read and write
 clean
2F20000
unkown
page read and write
 clean
28B5000
unkown
page readonly
 clean
270000
unkown
page read and write
 clean
27A4000
unkown
page readonly
 clean
2240000
unkown
page readonly
 clean
780000
unkown
page readonly
 clean
AEF000
unkown
page read and write
 clean
290000
unkown
page read and write
 clean
2578000
unkown
page readonly
 clean
25E2000
unkown
page readonly
 clean
2572000
unkown
page readonly
 clean
2832000
unkown
page readonly
 clean
2842000
unkown
page readonly
 clean
2AD2000
unkown
page readonly
 clean
2949000
unkown
page readonly
 clean
2912000
unkown
page readonly
 clean
3C4000
heap private
page read and write
 clean
2B50000
unkown
page readonly
 clean
28CD000
unkown
page readonly
 clean
1F70000
unkown
page write copy
 clean
F0000
unkown
page read and write
 clean
28D9000
unkown
page readonly
 clean
2150000
heap private
page read and write
 clean
2896000
unkown
page readonly
 clean
2965000
unkown
page readonly
 clean
2B30000
unkown
page readonly
 clean
64E000
unkown
page read and write
 clean
BC000
unkown
page read and write
 clean
25E8000
unkown
page readonly
 clean
2C6000
unkown
page read and write
 clean
2905000
unkown
page readonly
 clean
28F5000
unkown
page readonly
 clean
2095000
heap private
page read and write
 clean
2879000
unkown
page readonly
 clean
100000
heap default
page read and write
 clean
28C6000
unkown
page readonly
 clean
27F6000
unkown
page readonly
 clean
371000
heap default
page read and write
 clean
2866000
unkown
page readonly
 clean
366000
heap default
page read and write
 clean
2845000
unkown
page readonly
 clean
2B70000
unkown
page readonly
 clean
2752000
unkown
page readonly
 clean
2734000
unkown
page readonly
 clean
2895000
unkown
page readonly
 clean
28C5000
unkown
page readonly
 clean
1ED0000
unkown
page write copy
 clean
13D000
unkown
page read and write
 clean
2C50000
unkown
page readonly
 clean
There are 137 hidden memdumps, click here to show them.