Automated Malware Analysis IOC Report for

Processes

Path

Cmdline

Malicious

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding

Details

Is windows:	true
Is dropped:	false
PID:	508
Target ID:	0
Parent PID:	596
Name:	EXCEL.EXE
Class:	excel
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Commandline:	'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Size:	28253536
MD5:	D53B85E21886D2AF9815C377537BCAC3
Time:	17:13:20
Date:	12/10/2021
Reason:	newprocess
Reputation:	moderate
Is admin:	true
Is elevated:	true
Modulebase:	0x13fa70000
Modulesize:	28282880
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: Microsoft Office Product Spawning Windows Shell	System Summary
Sigma detected: Regsvr32 Command Line Without DLL	System Summary
Spawns processes	System Summary	Process Injection

C:\Windows\System32\regsvr32.exe

'C:\Windows\System32\regsvr32.exe' C:\Datop\test.test

Details

Is windows:	true
Is dropped:	false
PID:	1212
Target ID:	3
Parent PID:	508
Name:	regsvr32.exe
Class:	system-tools
Path:	C:\Windows\System32\regsvr32.exe
Commandline:	'C:\Windows\System32\regsvr32.exe' C:\Datop\test.test
Size:	19456
MD5:	59BCE9F07985F8A4204F4D6554CFF708
Time:	17:13:29
Date:	12/10/2021
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0xff1e0000
Modulesize:	32768
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Document exploit detected (process start blacklist hit)	Software Vulnerabilities	Exploitation for Client Execution
Sigma detected: Microsoft Office Product Spawning Windows Shell	System Summary
Sigma detected: Regsvr32 Command Line Without DLL	System Summary
Spawns processes	System Summary	Process Injection

C:\Windows\System32\regsvr32.exe

'C:\Windows\System32\regsvr32.exe' C:\Datop\test1.test

Details

Is windows:	true
Is dropped:	false
PID:	1444
Target ID:	4
Parent PID:	508
Name:	regsvr32.exe
Class:	system-tools
Path:	C:\Windows\System32\regsvr32.exe
Commandline:	'C:\Windows\System32\regsvr32.exe' C:\Datop\test1.test
Size:	19456
MD5:	59BCE9F07985F8A4204F4D6554CFF708
Time:	17:13:29
Date:	12/10/2021
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0xff1e0000
Modulesize:	32768
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Document exploit detected (process start blacklist hit)	Software Vulnerabilities	Exploitation for Client Execution
Sigma detected: Microsoft Office Product Spawning Windows Shell	System Summary
Sigma detected: Regsvr32 Command Line Without DLL	System Summary
Spawns processes	System Summary	Process Injection

C:\Windows\System32\regsvr32.exe

'C:\Windows\System32\regsvr32.exe' C:\Datop\test2.test

Details

Is windows:	true
Is dropped:	false
PID:	2792
Target ID:	5
Parent PID:	508
Name:	regsvr32.exe
Class:	system-tools
Path:	C:\Windows\System32\regsvr32.exe
Commandline:	'C:\Windows\System32\regsvr32.exe' C:\Datop\test2.test
Size:	19456
MD5:	59BCE9F07985F8A4204F4D6554CFF708
Time:	17:13:29
Date:	12/10/2021
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0xff1e0000
Modulesize:	32768
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Document exploit detected (process start blacklist hit)	Software Vulnerabilities	Exploitation for Client Execution
Sigma detected: Microsoft Office Product Spawning Windows Shell	System Summary
Sigma detected: Regsvr32 Command Line Without DLL	System Summary
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check

unknown

http://www.windows.com/pctv.

unknown

http://investor.msn.com

unknown

http://www.msnbc.com/news/ticker.txt

unknown

https://ohemaa.org/HUVm9mDKLW9C/ocrafhh.html

172.93.99.178

http://www.icra.org/vocabulary/.

unknown

http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.

unknown

https://madieandme.com.au/xnkpOLnvlN6T/ocrafh.html

101.0.112.4

http://investor.msn.com/

unknown

http://www.%s.comPA

unknown

http://windowsmedia.com/redir/services.asp?WMPFriendly=true

unknown

http://www.hotmail.com/oe

unknown

http://servername/isapibackend.dll

unknown

https://amerident.com.do/xdOMlaB0XJ7/ocraf.html

108.179.242.179

There are 4 hidden URLs, click here to show them.

Domains

Name

Malicious

ohemaa.org

172.93.99.178

Details

Name:	ohemaa.org
IP:	172.93.99.178
TargetID:	0
Current Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Potential document exploit detected (performs DNS queries)	Software Vulnerabilities	Exploitation for Client Execution
Potential document exploit detected (performs HTTP gets)	Software Vulnerabilities	Exploitation for Client Execution
Potential document exploit detected (unknown TCP traffic)	Software Vulnerabilities	Exploitation for Client Execution
Uses a known web browser user agent for HTTP communication	Networking	Application Layer Protocol
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Uses secure TLS version for HTTPS connections	Compliance, Networking

amerident.com.do

108.179.242.179

Details

Name:	amerident.com.do
IP:	108.179.242.179
TargetID:	0
Current Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Uses a known web browser user agent for HTTP communication	Networking	Application Layer Protocol
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Uses secure TLS version for HTTPS connections	Compliance, Networking

madieandme.com.au

101.0.112.4

Details

Name:	madieandme.com.au
IP:	101.0.112.4
TargetID:	0
Current Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Uses a known web browser user agent for HTTP communication	Networking	Application Layer Protocol
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Uses secure TLS version for HTTPS connections	Compliance, Networking

IPs

Domain

Country

Malicious

101.0.112.4

madieandme.com.au

Australia

Details

IP:	101.0.112.4
TargetID:	0
Current Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Country:	Australia
Countrycode:	AUS
ASN number:	55803
ASN name:	DIGITALPACIFIC-AUDigitalPacificPtyLtdAustraliaAU
Private:	false
Domain:	madieandme.com.au

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

108.179.242.179

amerident.com.do

United States

Details

IP:	108.179.242.179
TargetID:	0
Current Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Country:	United States
Countrycode:	USA
ASN number:	46606
ASN name:	UNIFIEDLAYER-AS-1US
Private:	false
Domain:	amerident.com.do

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

172.93.99.178

ohemaa.org

United States

Details

IP:	172.93.99.178
TargetID:	0
Current Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Country:	United States
Countrycode:	USA
ASN number:	23470
ASN name:	RELIABLESITEUS
Private:	false
Domain:	ohemaa.org

Signature Hits	Behavior Group	Mitre Attack
Potential document exploit detected (performs HTTP gets)	Software Vulnerabilities	Exploitation for Client Execution
Potential document exploit detected (unknown TCP traffic)	Software Vulnerabilities	Exploitation for Client Execution
Uses secure TLS version for HTTPS connections	Compliance, Networking

Registry

Path

Value

Malicious

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

9'$

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel

MTTT

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\ReviewCycle

ReviewToken

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\2EE64

2EE64

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage

VBAFiles

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

,+$

HKEY_CURRENT_USER_CLASSES\Local Settings\MuiCache\151\52C64B7E

@%SystemRoot%\system32\qagentrt.dll,-10

HKEY_CURRENT_USER_CLASSES\Local Settings\MuiCache\151\52C64B7E

@%SystemRoot%\System32\fveui.dll,-843

HKEY_CURRENT_USER_CLASSES\Local Settings\MuiCache\151\52C64B7E

@%SystemRoot%\System32\fveui.dll,-844

HKEY_CURRENT_USER_CLASSES\Local Settings\MuiCache\151\52C64B7E

@%SystemRoot%\System32\wuaueng.dll,-400

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Place MRU

Max Display