IOC Report

Processes

Path

Cmdline

Malicious

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding

Details

Is windows:	true
Is dropped:	false
PID:	1224
Target ID:	0
Parent PID:	596
Name:	EXCEL.EXE
Class:	excel
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Commandline:	'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Size:	28253536
MD5:	D53B85E21886D2AF9815C377537BCAC3
Time:	02:39:13
Date:	12/10/2021
Reason:	newprocess
Reputation:	moderate
Is admin:	true
Is elevated:	true
Modulebase:	0x13f0d0000
Modulesize:	28282880
Wow64:	false

Registry

Path

Value

Malicious

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

~s%

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel

MTTT

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage

VBAFiles

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\ReviewCycle

ReviewToken

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\2D29A

2D29A

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

wv%

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Place MRU

Max Display

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru

Max Display

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru

Item 1

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru

Item 2

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru

Item 3

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru

Item 4

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru

Item 5

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru

Item 6

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru

Item 7

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru

Item 8

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru

Item 9

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru

Item 10

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru

Item 11

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru

Item 12

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru

Item 13

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru

Item 14

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru

Item 15

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru

Item 16

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru

Item 17

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru

Item 18

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru

Item 19

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru

Item 20

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\3311E

3311E

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Place MRU

Max Display

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru

Max Display

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru

Item 1

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru

Item 2

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru

Item 3

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru

Item 4

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru

Item 5

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru

Item 6

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru

Item 7

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru

Item 8

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru

Item 9

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru

Item 10

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru

Item 11

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru

Item 12

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru

Item 13

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru

Item 14

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru

Item 15

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru

Item 16

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru

Item 17

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru

Item 18

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru

Item 19

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru

Item 20

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\331BA

331BA

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Security\Trusted Documents

LastPurgeTime

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages

1033

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages

1033

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage

EXCELFiles

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage

ProductFiles

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage

ProductFiles

There are 48 hidden registries, click here to show them.