IOCReport

loading gif

Files

File Path
Type
Category
Malicious
Order Request for Quotation.xlsx
CDFV2 Encrypted
initial sample
malicious
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vbc[1].exe
PE32 executable (GUI) Intel 80386, for MS Windows
downloaded
malicious
C:\Users\Public\vbc.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\187A408E.jpeg
[TIFF image data, big-endian, direntries=4], baseline, precision 8, 654x513, frames 3
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\3938F7BB.emf
Windows Enhanced Metafile (EMF) image data version 0x10000
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\3DA42481.jpeg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 150x150, segment length 16, baseline, precision 8, 1275x1650, frames 3
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\41CBDB37.png
PNG image data, 458 x 211, 8-bit/color RGB, non-interlaced
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\75377FBA.jpeg
[TIFF image data, big-endian, direntries=4], baseline, precision 8, 654x513, frames 3
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\89DF9873.png
PNG image data, 458 x 211, 8-bit/color RGB, non-interlaced
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\977CE15D.jpeg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 150x150, segment length 16, baseline, precision 8, 1275x1650, frames 3
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\CBDC1680.emf
Windows Enhanced Metafile (EMF) image data version 0x10000
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\F9110BCC.png
PNG image data, 816 x 552, 8-bit/color RGB, non-interlaced
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\FA538FD8.png
PNG image data, 816 x 552, 8-bit/color RGB, non-interlaced
dropped
clean
C:\Users\user\Desktop\~$Order Request for Quotation.xlsx
data
dropped
clean
There are 4 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding
malicious
C:\Users\Public\vbc.exe
'C:\Users\Public\vbc.exe'
malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
clean

URLs

Name
IP
Malicious
http://198.12.91.134/hkcmd/vbc.exe
198.12.91.134
malicious
http://www.day.com/dam/1.0
unknown
clean

IPs

IP
Domain
Country
Malicious
198.12.91.134
unknown
United States
malicious

Registry

Path
Value
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
tz9
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
MTTT
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ReviewToken
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EEBD5
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
FontCachePath
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
VBAFiles
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
%'9
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
F3987
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
F43B5
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 21
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
LastPurgeTime
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1033
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1033
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EXCELFiles
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Name
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
F3987
clean
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
EquationEditorFilesIntl_1033
clean
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
SavedLegacySettings
clean
There are 33 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
3D0000
unkown
page execute and read and write
malicious
420000
unkown
page readonly
clean
29B000
heap private
page read and write
clean
25B0000
unkown
page read and write
clean
1D94000
heap private
page read and write
clean
3036000
unkown
page readonly
clean
24D0000
unkown
page readonly
clean
1C50000
unkown
page read and write
clean
2D52000
unkown
page readonly
clean
2FF5000
unkown
page readonly
clean
2FD6000
unkown
page readonly
clean
415000
unkown image
page read and write
clean
1D08000
heap private
page read and write
clean
1CE0000
heap private
page read and write
clean
30B2000
unkown
page readonly
clean
250000
unkown
page read and write
clean
30B9000
unkown
page readonly
clean
260000
heap private
page read and write
clean
5A0000
unkown
page readonly
clean
2FA6000
unkown
page readonly
clean
294000
heap private
page read and write
clean
3075000
unkown
page readonly
clean
3059000
unkown
page readonly
clean
2F12000
unkown
page readonly
clean
3242000
unkown
page readonly
clean
401000
unkown image
page execute read
clean
400000
unkown image
page readonly
clean
3052000
unkown
page readonly
clean
3280000
unkown
page readonly
clean
2F82000
unkown
page readonly
clean
32A0000
unkown
page readonly
clean
5C0000
heap default
page read and write
clean
220000
unkown
page execute read
clean
303D000
unkown
page readonly
clean
230000
unkown
page readonly
clean
1DB2000
heap private
page read and write
clean
2F54000
unkown
page readonly
clean
3039000
unkown
page readonly
clean
2F34000
unkown
page readonly
clean
2D0000
unkown
page read and write
clean
400000
unkown image
page readonly
clean
298000
heap private
page read and write
clean
3E0000
unkown
page readonly
clean
350000
heap default
page read and write
clean
2F14000
unkown
page readonly
clean
2200000
unkown
page readonly
clean
401000
unkown image
page execute read
clean
240000
heap private
page read and write
clean
2E52000
unkown
page readonly
clean
2D58000
unkown
page readonly
clean
30D5000
unkown
page readonly
clean
2FB2000
unkown
page readonly
clean
3089000
unkown
page readonly
clean
3025000
unkown
page readonly
clean
5C7000
heap default
page read and write
clean
400000
unkown image
page readonly
clean
417000
unkown image
page readonly
clean
2FC5000
unkown
page readonly
clean
2F95000
unkown
page readonly
clean
280000
unkown
page readonly
clean
29D0000
unkown
page readonly
clean
30A5000
unkown
page readonly
clean
29B0000
unkown
page readonly
clean
3006000
unkown
page readonly
clean
417000
unkown image
page readonly
clean
5E4000
heap default
page read and write
clean
7EFDF000
unkown
page read and write
clean
89000
unkown
page read and write
clean
2F32000
unkown
page readonly
clean
3082000
unkown
page readonly
clean
1DF0000
heap private
page read and write
clean
3012000
unkown
page readonly
clean
2F52000
unkown
page readonly
clean
850000
unkown
page readonly
clean
20000
unkown
page read and write
clean
2FE2000
unkown
page readonly
clean
270000
unkown
page write copy
clean
1CEA000
heap private
page read and write
clean
1D90000
heap private
page read and write
clean
18C000
unkown
page read and write
clean
1B0000
unkown
page readonly
clean
32C0000
unkown
page readonly
clean
1E00000
unkown
page read and write
clean
290000
heap private
page read and write
clean
There are 74 hidden memdumps, click here to show them.