IOCReport

loading gif

Files

File Path
Type
Category
Malicious
Inquiry Sheet.xlsx
CDFV2 Encrypted
initial sample
malicious
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vbc[1].exe
PE32 executable (GUI) Intel 80386, for MS Windows
downloaded
malicious
C:\Users\user\Desktop\~$Inquiry Sheet.xlsx
data
dropped
malicious
C:\Users\Public\vbc.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\13D19963.emf
Windows Enhanced Metafile (EMF) image data version 0x10000
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\1C86035F.png
PNG image data, 476 x 244, 8-bit/color RGB, non-interlaced
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\2C6D05D4.png
PNG image data, 613 x 80, 8-bit/color RGBA, non-interlaced
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\3469E5BD.png
PNG image data, 684 x 477, 8-bit/color RGBA, non-interlaced
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\39CC72E1.jpeg
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 191x263, frames 3
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\3A88E756.jpeg
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 333x151, frames 3
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\438FC3C5.png
PNG image data, 684 x 477, 8-bit/color RGBA, non-interlaced
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\48F669AC.png
PNG image data, 613 x 80, 8-bit/color RGBA, non-interlaced
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\4A5EF89A.jpeg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 0x0, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=2], baseline, precision 8, 474x379, frames 3
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\7F6D3C08.jpeg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 150x150, segment length 16, baseline, precision 8, 1275x1650, frames 3
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\85D16660.jpeg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 150x150, segment length 16, baseline, precision 8, 1275x1650, frames 3
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\9D207B6E.jpeg
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 333x151, frames 3
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\BEC4B86A.emf
Windows Enhanced Metafile (EMF) image data version 0x10000
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\CA746F1B.png
PNG image data, 566 x 429, 8-bit/color RGBA, non-interlaced
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\D48A6F02.jpeg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 0x0, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=2], baseline, precision 8, 474x379, frames 3
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\DB3F3C69.jpeg
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 191x263, frames 3
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\E4E9FBD3.png
PNG image data, 566 x 429, 8-bit/color RGBA, non-interlaced
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\F9921897.png
PNG image data, 476 x 244, 8-bit/color RGB, non-interlaced
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\mso4138.tmp
PC bitmap, Windows 3.x format, 20 x 20 x 24
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\mso4167.tmp
PC bitmap, Windows 3.x format, 20 x 20 x 24
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\mso4168.tmp
PC bitmap, Windows 3.x format, 20 x 20 x 24
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\msoF0B5.tmp
PC bitmap, Windows 3.x format, 20 x 20 x 24
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\msoF0B6.tmp
PC bitmap, Windows 3.x format, 20 x 20 x 24
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\msoF0B7.tmp
PC bitmap, Windows 3.x format, 20 x 20 x 24
dropped
clean
There are 18 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding
malicious
C:\Users\Public\vbc.exe
'C:\Users\Public\vbc.exe'
malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
clean

URLs

Name
IP
Malicious
http://212.192.246.25/excel/vbc.exe
212.192.246.25
malicious
http://37.0.11.217/WEALTHYREM_ecI
malicious
http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
unknown
clean
http://www.windows.com/pctv.
unknown
clean
http://investor.msn.com
unknown
clean
http://www.msnbc.com/news/ticker.txt
unknown
clean
http://www.icra.org/vocabulary/.
unknown
clean
http://windowsmedia.com/redir/services.asp?WMPFriendly=true
unknown
clean
http://www.hotmail.com/oe
unknown
clean
http://www.day.com/dam/1.0
unknown
clean
http://investor.msn.com/
unknown
clean
There are 1 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
212.192.246.25
unknown
Russian Federation
malicious

Registry

Path
Value
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
't-
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
MTTT
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ReviewToken
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
2E781
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
FontCachePath
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
VBAFiles
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
r#-
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
33801
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
34099
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 21
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
LastPurgeTime
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1033
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1033
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EXCELFiles
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Name
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
33801
clean
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
EquationEditorFilesIntl_1033
clean
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
SavedLegacySettings
clean
There are 33 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
320000
unkown
page execute and read and write
malicious
5A0000
unkown image
page readonly
clean
2710000
heap private
page read and write
clean
300000
unkown image
page readonly
clean
1CC0000
unkown
page read and write
clean
20000
unkown
page read and write
clean
11D000
unkown
page read and write
clean
7EFC2000
unkown image
page readonly
clean
730000
unkown image
page readonly
clean
C5F000
unkown
page read and write
clean
2C0000
unkown image
page read and write
clean
7FFFFFB2000
unkown image
page readonly
clean
7FFFFFC0000
unkown image
page readonly
clean
2B0000
unkown image
page readonly
clean
230000
heap private
page read and write
clean
41D000
unkown image
page read and write
clean
720000
unkown image
page readonly
clean
190000
unkown image
page readonly
clean
4C4000
heap default
page read and write
clean
24F4000
heap private
page read and write
clean
234000
heap private
page read and write
clean
390000
heap private
page read and write
clean
3220000
unkown image
page readonly
clean
30000
unkown image
page readonly
clean
7FFFFFC2000
unkown image
page readonly
clean
2714000
heap private
page read and write
clean
7EFE0000
unkown image
page readonly
clean
2732000
heap private
page read and write
clean
24F8000
heap private
page read and write
clean
10000
unkown image
page read and write
clean
7EFD0000
unkown image
page readonly
clean
7EFC0000
unkown image
page readonly
clean
2E0000
unkown image
page readonly
clean
7EFC2000
unkown image
page readonly
clean
422000
unkown image
page readonly
clean
7EFB0000
unkown image
page readonly
clean
7FFFFFB2000
unkown image
page readonly
clean
2430000
heap private
page read and write
clean
18C000
unkown
page read and write
clean
3407000
unkown image
page readonly
clean
28E0000
heap private
page read and write
clean
65F000
unkown
page read and write
clean
33D000
heap default
page read and write
clean
7EFDF000
unkown
page read and write
clean
34B000
heap default
page read and write
clean
7EFD0000
unkown image
page readonly
clean
4A7000
heap default
page read and write
clean
4A0000
heap default
page read and write
clean
401000
unkown image
page execute read
clean
88000
unkown
page read and write
clean
436000
unkown
page read and write
clean
7EFB2000
unkown image
page readonly
clean
7EFE0000
unkown image
page readonly
clean
2458000
heap private
page read and write
clean
220000
heap default
page read and write
clean
8C0000
unkown image
page readonly
clean
243A000
heap private
page read and write
clean
400000
unkown image
page readonly
clean
7FFFFFB0000
unkown image
page readonly
clean
7EFB2000
unkown image
page readonly
clean
A7F000
unkown
page read and write
clean
346000
heap default
page read and write
clean
400000
unkown image
page readonly
clean
7FFFFFD0000
unkown image
page readonly
clean
7FFFFFC0000
unkown image
page readonly
clean
7FFFFFC2000
unkown image
page readonly
clean
4DF000
heap default
page read and write
clean
7EFB0000
unkown image
page readonly
clean
370000
heap private
page read and write
clean
2390000
unkown
page read and write
clean
7FFFFFB0000
unkown image
page readonly
clean
300000
heap default
page read and write
clean
24FB000
heap private
page read and write
clean
400000
unkown image
page readonly
clean
307000
heap default
page read and write
clean
401000
unkown image
page execute read
clean
40000
unkown image
page readonly
clean
422000
unkown image
page readonly
clean
2530000
unkown image
page readonly
clean
10000
unkown image
page read and write
clean
400000
unkown
page read and write
clean
7FFFFFD0000
unkown image
page readonly
clean
24F0000
heap private
page read and write
clean
2A0000
unkown
page execute read
clean
B3F000
unkown
page read and write
clean
7EFC0000
unkown image
page readonly
clean
420000
unkown image
page read and write
clean
There are 77 hidden memdumps, click here to show them.