IOCReport

loading gif

Files

File Path
Type
Category
Malicious
85095f36_by_Libranalysis.xls
Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1251, Author: van-van, Last Saved By: vi-vi, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Wed May 12 08:24:11 2021, Security: 0
initial sample
 malicious
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
Microsoft Cabinet archive data, 59863 bytes, 1 file
dropped
 clean
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A
data
dropped
 clean
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
data
dropped
 clean
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A
data
dropped
 clean
C:\Users\user\AppData\Local\Temp\9CDE0000
data
dropped
 clean
C:\Users\user\AppData\Local\Temp\CabE81F.tmp
Microsoft Cabinet archive data, 59863 bytes, 1 file
dropped
 clean
C:\Users\user\AppData\Local\Temp\TarE820.tmp
data
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\85095f36_by_Libranalysis.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu May 13 03:06:28 2021, mtime=Thu May 13 03:06:41 2021, atime=Thu May 13 03:06:42 2021, length=174080, window=hide
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Tue Oct 17 10:04:00 2017, mtime=Thu May 13 03:06:41 2021, atime=Thu May 13 03:06:41 2021, length=8192, window=hide
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
ASCII text, with CRLF line terminators
dropped
 clean
C:\Users\user\Desktop\9DDE0000
Applesoft BASIC program data, first line number 16
dropped
 clean
There are 2 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
 malicious
C:\Windows\System32\rundll32.exe
rundll32 ..\ritofm.cvm,DllRegisterServer
 malicious
C:\Windows\System32\rundll32.exe
rundll32 ..\ritofm.cvm1,DllRegisterServer
 malicious

URLs

Name
IP
Malicious
http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
unknown
 clean
http://www.windows.com/pctv.
unknown
 clean
http://investor.msn.com
unknown
 clean
http://www.msnbc.com/news/ticker.txt
unknown
 clean
http://www.icra.org/vocabulary/.
unknown
 clean
http://windowsmedia.com/redir/services.asp?WMPFriendly=true
unknown
 clean
http://www.hotmail.com/oe
unknown
 clean
http://investor.msn.com/
unknown
 clean

Domains

Name
IP
Malicious
signifysystem.com
192.185.39.58
 clean
fcventasyservicios.cl
192.185.32.232
 clean

IPs

IP
Domain
Country
Malicious
192.185.39.58
signifysystem.com
United States
clean
192.185.32.232
fcventasyservicios.cl
United States
clean

Registry

Path
Value
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
!|7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
MTTT
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ReviewToken
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ED7E8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
VBAFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
DefaultSheetR2L
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
UseSystemSeparators
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ThousandsSeparator
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
DecimalSeparator
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EDAA6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EDBA0
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EDC2C
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EDD26
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EDE8C
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
{E7E4BC40-E76A-11CE-A9BB-00AA004AE837} {000214E6-0000-0000-C000-000000000046} 0xFFFF
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
%'8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\system32\qagentrt.dll,-10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\System32\fveui.dll,-843
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\System32\fveui.dll,-844
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\System32\wuaueng.dll,-400
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
LastPurgeTime
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
115AEC
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
11698C
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EXCELFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SavedLegacySettings
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
There are 111 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
376000
unkown
page read and write
 clean
100000
heap private
page read and write
 clean
35E000
heap default
page read and write
 clean
2A39000
unkown
page readonly
 clean
2D15000
heap private
page read and write
 clean
200000
unkown
page read and write
 clean
2390000
unkown
page readonly
 clean
2BD0000
unkown
page readonly
 clean
21A0000
heap private
page read and write
 clean
22C0000
unkown
page readonly
 clean
2949000
unkown
page readonly
 clean
1C0000
heap private
page read and write
 clean
456000
unkown
page read and write
 clean
480000
unkown
page readonly
 clean
2D10000
heap private
page read and write
 clean
2A69000
unkown
page readonly
 clean
E0000
unkown
page read and write
 clean
2BF0000
unkown
page read and write
 clean
600000
unkown
page readonly
 clean
2916000
unkown
page readonly
 clean
334000
heap private
page read and write
 clean
420000
unkown
page read and write
 clean
2905000
unkown
page readonly
 clean
2762000
unkown
page readonly
 clean
2A05000
unkown
page readonly
 clean
2864000
unkown
page readonly
 clean
2662000
unkown
page readonly
 clean
20000
unkown
page readonly
 clean
29C9000
unkown
page readonly
 clean
E0000
unkown
page read and write
 clean
2962000
unkown
page readonly
 clean
21DB000
heap private
page read and write
 clean
294D000
unkown
page readonly
 clean
2B90000
unkown
page readonly
 clean
2738000
unkown
page readonly
 clean
2862000
unkown
page readonly
 clean
28F2000
unkown
page readonly
 clean
2319000
heap private
page read and write
 clean
2A85000
unkown
page readonly
 clean
1BA0000
unkown
page readonly
 clean
2986000
unkown
page readonly
 clean
2B52000
unkown
page readonly
 clean
2892000
unkown
page readonly
 clean
20000
unkown
page readonly
 clean
29E6000
unkown
page readonly
 clean
236000
unkown
page read and write
 clean
2824000
unkown
page readonly
 clean
6B0000
unkown
page readonly
 clean
28F2000
unkown
page readonly
 clean
28E6000
unkown
page readonly
 clean
21A5000
heap private
page read and write
 clean
28B6000
unkown
page readonly
 clean
2CA0000
unkown
page readonly
 clean
2A62000
unkown
page readonly
 clean
2A55000
unkown
page readonly
 clean
1D87000
unkown
page readonly
 clean
2992000
unkown
page readonly
 clean
D0000
unkown
page read and write
 clean
2962000
unkown
page readonly
 clean
60000
unkown
page readonly
 clean
327000
heap default
page read and write
 clean
29B5000
unkown
page readonly
 clean
320000
heap default
page read and write
 clean
1C4000
heap private
page read and write
 clean
4BE000
unkown
page read and write
 clean
2A16000
unkown
page readonly
 clean
2932000
unkown
page readonly
 clean
2245000
heap private
page read and write
 clean
2914000
unkown
page readonly
 clean
104000
heap private
page read and write
 clean
22E0000
unkown
page readonly
 clean
110000
unkown
page write copy
 clean
27D000
heap default
page read and write
 clean
520000
unkown
page readonly
 clean
2240000
heap private
page read and write
 clean
2040000
heap private
page read and write
 clean
20C0000
unkown
page readonly
 clean
2C80000
unkown
page readonly
 clean
29D5000
unkown
page readonly
 clean
2999000
unkown
page readonly
 clean
6A0000
unkown
page readonly
 clean
2934000
unkown
page readonly
 clean
380000
heap default
page read and write
 clean
2935000
unkown
page readonly
 clean
2C60000
unkown
page readonly
 clean
28D5000
unkown
page readonly
 clean
2A1D000
unkown
page readonly
 clean
28B000
heap default
page read and write
 clean
29C2000
unkown
page readonly
 clean
240000
heap default
page read and write
 clean
28F4000
unkown
page readonly
 clean
28C2000
unkown
page readonly
 clean
2832000
unkown
page readonly
 clean
60000
unkown
page readonly
 clean
2A32000
unkown
page readonly
 clean
29B6000
unkown
page readonly
 clean
20B0000
heap private
page read and write
 clean
2315000
heap private
page read and write
 clean
2A19000
unkown
page readonly
 clean
387000
heap default
page read and write
 clean
2946000
unkown
page readonly
 clean
29C2000
unkown
page readonly
 clean
2A99000
unkown
page readonly
 clean
29E5000
unkown
page readonly
 clean
2BB0000
unkown
page readonly
 clean
16D000
unkown
page read and write
 clean
2D4B000
heap private
page read and write
 clean
2992000
unkown
page readonly
 clean
29A5000
unkown
page readonly
 clean
3BE000
heap default
page read and write
 clean
2310000
heap private
page read and write
 clean
2A92000
unkown
page readonly
 clean
2842000
unkown
page readonly
 clean
2D90000
unkown
page readonly
 clean
29F2000
unkown
page readonly
 clean
2822000
unkown
page readonly
 clean
2922000
unkown
page readonly
 clean
2C22000
unkown
page readonly
 clean
2220000
unkown
page readonly
 clean
AEF000
unkown
page read and write
 clean
28A5000
unkown
page readonly
 clean
340000
unkown
page read and write
 clean
2AB5000
unkown
page readonly
 clean
2985000
unkown
page readonly
 clean
286000
heap default
page read and write
 clean
60000
unkown
page readonly
 clean
2732000
unkown
page readonly
 clean
2F90000
unkown
page read and write
 clean
1F80000
unkown
page write copy
 clean
1FB000
unkown
page read and write
 clean
2CC0000
unkown
page readonly
 clean
23B0000
unkown
page readonly
 clean
2249000
heap private
page read and write
 clean
330000
heap private
page read and write
 clean
2969000
unkown
page readonly
 clean
2844000
unkown
page readonly
 clean
2668000
unkown
page readonly
 clean
2975000
unkown
page readonly
 clean
2912000
unkown
page readonly
 clean
247000
heap default
page read and write
 clean
1C40000
unkown
page readonly
 clean
1E27000
unkown
page readonly
 clean
A0F000
unkown
page read and write
 clean
D0000
unkown
page read and write
 clean
24B000
unkown
page read and write
 clean
There are 135 hidden memdumps, click here to show them.