IOCReport

loading gif

Files

File Path
Type
Category
Malicious
CMA-CGM BOOKING CONFIRMATION.xlsx
CDFV2 Encrypted
initial sample
malicious
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\.svchost[1].exe
PE32 executable (GUI) Intel 80386, for MS Windows
downloaded
malicious
C:\Users\user\Desktop\~$CMA-CGM BOOKING CONFIRMATION.xlsx
data
dropped
malicious
C:\Users\Public\vbc.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\23D48948.jpeg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 150x150, segment length 16, baseline, precision 8, 1275x1650, frames 3
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\31DE0BA3.png
PNG image data, 816 x 552, 8-bit/color RGB, non-interlaced
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\3B0A6367.emf
Windows Enhanced Metafile (EMF) image data version 0x10000
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\887DE696.png
PNG image data, 816 x 552, 8-bit/color RGB, non-interlaced
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\9D9EA3AA.jpeg
[TIFF image data, big-endian, direntries=4], baseline, precision 8, 654x513, frames 3
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\B536090D.jpeg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 150x150, segment length 16, baseline, precision 8, 1275x1650, frames 3
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\D831163C.emf
Windows Enhanced Metafile (EMF) image data version 0x10000
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\E885A8A9.jpeg
[TIFF image data, big-endian, direntries=4], baseline, precision 8, 654x513, frames 3
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\mso3C39.tmp
PC bitmap, Windows 3.x format, 20 x 20 x 24
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\mso3C3A.tmp
PC bitmap, Windows 3.x format, 20 x 20 x 24
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\mso3C3B.tmp
PC bitmap, Windows 3.x format, 20 x 20 x 24
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\msoE456.tmp
PC bitmap, Windows 3.x format, 20 x 20 x 24
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\msoE457.tmp
PC bitmap, Windows 3.x format, 20 x 20 x 24
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\msoE487.tmp
PC bitmap, Windows 3.x format, 20 x 20 x 24
dropped
clean
There are 8 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding
malicious
C:\Users\Public\vbc.exe
'C:\Users\Public\vbc.exe'
malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
clean

URLs

Name
IP
Malicious
https://kinmirai.org/wp-content/bin_QVwo
malicious
http://180.214.239.39/disk/.svchost.exe
180.214.239.39
malicious
http://www.day.com/dam/1.0
unknown
clean

IPs

IP
Domain
Country
Malicious
180.214.239.39
unknown
Viet Nam
malicious

Registry

Path
Value
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
5'4
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
MTTT
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ReviewToken
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EDF48
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
FontCachePath
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
VBAFiles
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
q/4
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
F2D28
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
F3B6B
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 21
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
LastPurgeTime
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1033
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1033
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EXCELFiles
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Name
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
F2D28
clean
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
EquationEditorFilesIntl_1033
clean
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
SavedLegacySettings
clean
There are 33 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
3B0000
unkown
page execute and read and write
malicious
500000
heap private
page read and write
clean
20000
unkown
page read and write
clean
401000
unkown image
page execute read
clean
2562000
heap private
page read and write
clean
401000
unkown image
page execute read
clean
1D40000
unkown
page read and write
clean
2580000
unkown
page read and write
clean
350000
heap private
page read and write
clean
940000
unkown
page readonly
clean
437000
unkown image
page read and write
clean
220000
heap private
page read and write
clean
450000
unkown
page read and write
clean
35A000
heap private
page read and write
clean
2540000
heap private
page read and write
clean
544000
heap default
page read and write
clean
7EFDF000
unkown
page read and write
clean
310000
unkown
page read and write
clean
2544000
heap private
page read and write
clean
230000
heap private
page read and write
clean
270000
heap private
page read and write
clean
3A0000
unkown
page readonly
clean
438000
unkown image
page readonly
clean
18D000
unkown
page read and write
clean
377000
heap private
page read and write
clean
520000
heap default
page read and write
clean
2410000
unkown
page readonly
clean
400000
unkown image
page readonly
clean
300000
unkown
page execute read
clean
340000
unkown
page readonly
clean
400000
unkown image
page readonly
clean
620000
unkown
page readonly
clean
89000
unkown
page read and write
clean
438000
unkown image
page readonly
clean
1B0000
unkown
page readonly
clean
280000
heap default
page read and write
clean
7A0000
unkown
page readonly
clean
527000
heap default
page read and write
clean
2140000
unkown
page readonly
clean
400000
unkown image
page readonly
clean
2980000
unkown
page read and write
clean
There are 31 hidden memdumps, click here to show them.