IOCReport

loading gif

Files

File Path
Type
Category
Malicious
#U0110#U1eb6T MUA H#U00c0NG VNU_014092021.xlsx
CDFV2 Encrypted
initial sample
malicious
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vbc[1].exe
PE32 executable (GUI) Intel 80386, for MS Windows
downloaded
malicious
C:\Users\user\Desktop\~$#U0110#U1eb6T MUA H#U00c0NG VNU_014092021.xlsx
data
dropped
malicious
C:\Users\Public\vbc.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
malicious
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\1A0B8B0A.png
PNG image data, 476 x 244, 8-bit/color RGB, non-interlaced
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\2F521389.jpeg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 0x0, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=2], baseline, precision 8, 474x379, frames 3
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\30D76811.jpeg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 0x0, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=2], baseline, precision 8, 474x379, frames 3
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\35493F6.png
PNG image data, 566 x 429, 8-bit/color RGBA, non-interlaced
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\382BCCC6.emf
Windows Enhanced Metafile (EMF) image data version 0x10000
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\3A9AFE9C.jpeg
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 191x263, frames 3
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\3D45ADF5.jpeg
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 333x151, frames 3
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\4D264A0F.jpeg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 150x150, segment length 16, baseline, precision 8, 1275x1650, frames 3
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\67EABCC4.jpeg
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 191x263, frames 3
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\78100EDE.png
PNG image data, 566 x 429, 8-bit/color RGBA, non-interlaced
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\7FF60B83.png
PNG image data, 613 x 80, 8-bit/color RGBA, non-interlaced
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\8E3548CB.png
PNG image data, 613 x 80, 8-bit/color RGBA, non-interlaced
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\8F889450.png
PNG image data, 684 x 477, 8-bit/color RGBA, non-interlaced
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\988D15ED.jpeg
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 333x151, frames 3
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\A7DFC7A8.png
PNG image data, 684 x 477, 8-bit/color RGBA, non-interlaced
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\DCC67372.png
PNG image data, 476 x 244, 8-bit/color RGB, non-interlaced
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\EA784B99.emf
Windows Enhanced Metafile (EMF) image data version 0x10000
dropped
clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\F26B3547.jpeg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 150x150, segment length 16, baseline, precision 8, 1275x1650, frames 3
dropped
clean
There are 12 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding
malicious
C:\Users\Public\vbc.exe
'C:\Users\Public\vbc.exe'
malicious
C:\Users\Public\vbc.exe
'C:\Users\Public\vbc.exe'
malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
clean

URLs

Name
IP
Malicious
http://23.95.85.181/0789/vbc.exe
23.95.85.181
malicious
http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
unknown
clean
http://www.icra.org/vocabulary/.
unknown
clean
http://windowsmedia.com/redir/services.asp?WMPFriendly=true
unknown
clean
http://www.day.com/dam/1.0
unknown
clean

IPs

IP
Domain
Country
Malicious
23.95.85.181
unknown
United States
malicious

Registry

Path
Value
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
2j&
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
MTTT
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ReviewToken
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
3058C
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
FontCachePath
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
VBAFiles
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
zy&
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
3585D
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
36190
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 21
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
LastPurgeTime
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1033
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1033
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EXCELFiles
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Name
clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
3585D
clean
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
EquationEditorFilesIntl_1033
clean
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
SavedLegacySettings
clean
There are 33 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
3D0000
unkown
page execute and read and write
malicious
1B0000
unkown
page execute and read and write
malicious
40000
unkown image
page readonly
clean
190000
unkown image
page readonly
clean
7EFC0000
unkown image
page readonly
clean
41D000
unkown image
page readonly
clean
7FFFFFC2000
unkown image
page readonly
clean
1C4F000
unkown
page read and write
clean
190000
unkown image
page readonly
clean
7FFFFFD0000
unkown image
page readonly
clean
2570000
unkown image
page readonly
clean
41D000
unkown image
page readonly
clean
7EFB0000
unkown image
page readonly
clean
20000
unkown
page read and write
clean
7EFD0000
unkown image
page readonly
clean
200000
heap default
page read and write
clean
7EFDF000
unkown
page read and write
clean
1CF0000
unkown
page read and write
clean
7EFB2000
unkown image
page readonly
clean
190000
unkown image
page readonly
clean
7EFB0000
unkown image
page readonly
clean
401000
unkown image
page execute read
clean
2DB000
heap default
page read and write
clean
380000
heap default
page read and write
clean
7EFC2000
unkown image
page readonly
clean
7EFD0000
unkown image
page readonly
clean
680000
unkown image
page readonly
clean
13D000
unkown
page read and write
clean
41D000
unkown image
page readonly
clean
3C6000
unkown
page read and write
clean
1E69F000
unkown
page read and write
clean
2770000
heap private
page read and write
clean
7EFC2000
unkown image
page readonly
clean
390000
unkown
page read and write
clean
55E000
unkown
page read and write
clean
7FFFFFC2000
unkown image
page readonly
clean
1C84000
heap private
page read and write
clean
1C0000
unkown image
page readonly
clean
2D6000
heap default
page read and write
clean
4E0000
heap private
page read and write
clean
1C80000
heap private
page read and write
clean
297000
heap default
page read and write
clean
8B0000
unkown image
page readonly
clean
4C0000
heap private
page read and write
clean
7EFD0000
unkown image
page readonly
clean
7EFE0000
unkown image
page readonly
clean
7EFE0000
unkown image
page readonly
clean
2558000
heap private
page read and write
clean
400000
unkown image
page readonly
clean
3297000
unkown image
page readonly
clean
4C4000
heap private
page read and write
clean
7EFB2000
unkown image
page readonly
clean
7EFC2000
unkown image
page readonly
clean
3E0000
unkown
page read and write
clean
7EFD0000
unkown image
page readonly
clean
18E000
unkown
page read and write
clean
2530000
heap private
page read and write
clean
1CE0000
heap private
page read and write
clean
20000
unkown
page read and write
clean
2420000
heap private
page read and write
clean
18C000
unkown
page read and write
clean
7EFC0000
unkown image
page readonly
clean
10000
unkown image
page read and write
clean
7EFB2000
unkown image
page readonly
clean
2424000
heap private
page read and write
clean
8F0000
heap private
page read and write
clean
630000
heap default
page read and write
clean
7FFFFFD0000
unkown image
page readonly
clean
1F0000
unkown image
page readonly
clean
7EFB2000
unkown image
page readonly
clean
1C8B000
heap private
page read and write
clean
730000
unkown image
page readonly
clean
7FFFFFB2000
unkown image
page readonly
clean
7FFFFFC0000
unkown image
page readonly
clean
A90000
unkown image
page readonly
clean
7EFB0000
unkown image
page readonly
clean
41B000
unkown image
page read and write
clean
400000
unkown image
page readonly
clean
7EFC0000
unkown image
page readonly
clean
274F000
unkown
page read and write
clean
900000
unkown image
page readonly
clean
7EFC0000
unkown image
page readonly
clean
7FFFFFC0000
unkown image
page readonly
clean
2F4000
heap default
page read and write
clean
2460000
unkown
page read and write
clean
290000
heap default
page read and write
clean
290000
unkown image
page readonly
clean
7EFDF000
unkown
page read and write
clean
B2F000
unkown
page read and write
clean
400000
unkown image
page readonly
clean
7EFB0000
unkown image
page readonly
clean
CAF000
unkown
page read and write
clean
7EFC0000
unkown image
page readonly
clean
63F000
unkown
page read and write
clean
2CD000
heap default
page read and write
clean
10000
unkown image
page read and write
clean
1D0000
unkown image
page read and write
clean
190000
unkown image
page readonly
clean
7EFB0000
unkown image
page readonly
clean
7EFB2000
unkown image
page readonly
clean
7EFC2000
unkown image
page readonly
clean
2D7000
heap default
page read and write
clean
7EFC2000
unkown image
page readonly
clean
7EFB2000
unkown image
page readonly
clean
7FFFFFB0000
unkown image
page readonly
clean
401000
unkown image
page execute read
clean
400000
unkown image
page readonly
clean
4F0000
unkown image
page readonly
clean
7EFE0000
unkown image
page readonly
clean
401000
unkown image
page execute read
clean
7EFD0000
unkown image
page readonly
clean
30B0000
unkown image
page readonly
clean
7EFB0000
unkown image
page readonly
clean
8D000
unkown
page read and write
clean
400000
unkown image
page readonly
clean
253A000
heap private
page read and write
clean
7EFD0000
unkown image
page readonly
clean
637000
heap default
page read and write
clean
7FFFFFB2000
unkown image
page readonly
clean
4CF000
unkown
page read and write
clean
670000
unkown image
page readonly
clean
1C88000
heap private
page read and write
clean
654000
heap default
page read and write
clean
10000
unkown image
page read and write
clean
7EFC2000
unkown image
page readonly
clean
2D0000
heap default
page read and write
clean
7FFFFFB0000
unkown image
page readonly
clean
1B0000
unkown
page execute read
clean
8A000
unkown
page read and write
clean
7EFC0000
unkown image
page readonly
clean
34A1000
unkown
page read and write
clean
2442000
heap private
page read and write
clean
30000
unkown image
page readonly
clean
There are 123 hidden memdumps, click here to show them.