IOCReport

document-47-2637.xls

Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Author: Windows User, Last Saved By: Windows User, Name of Creating Application: Microsoft Excel, Create Time/Date: Wed Jun 2 14:40:34 2021, Last Saved Time/Date: Wed Jun 2 14:40:36 2021, Security: 1

initial sample

C:\aZ8ThU0Y\ERdZMUem\nnAzot.exe

PE32 executable (GUI) Intel 80386, for MS Windows

dropped

C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding

C:\Windows\SysWOW64\cmd.exe

'C:\Windows\System32\cmd.exe' /c copy '%ProgramFiles(x86)%\Internet Explorer\ExtExport.exe' C:\aZ8ThU0Y\ERdZMUem\nnAzot.exe

C:\aZ8ThU0Y\ERdZMUem\nnAzot.exe

'C:\aZ8ThU0Y\ERdZMUem\nnAzot.exe' C:\aZ8ThU0Y\ERdZMUem GdPT AuMr7

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding

C:\Windows\System32\cmd.exe

'C:\Windows\System32\cmd.exe' /c copy '%ProgramFiles(x86)%\Internet Explorer\ExtExport.exe' C:\aZ8ThU0Y\ERdZMUem\nnAzot.exe