Source: Process started | Author: Michael Haag, Florian Roth, Markus Neis, Elastic, FPT.EagleEye Team: Data: Command: wmic process call create "mshta C:\ProgramData\LZbir.rtf", CommandLine: wmic process call create "mshta C:\ProgramData\LZbir.rtf", CommandLine|base64offset|contains: h, Image: C:\Windows\System32\wbem\WMIC.exe, NewProcessName: C:\Windows\System32\wbem\WMIC.exe, OriginalFileName: C:\Windows\System32\wbem\WMIC.exe, ParentCommandLine: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding, ParentImage: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ParentProcessId: 2140, ProcessCommandLine: wmic process call create "mshta C:\ProgramData\LZbir.rtf", ProcessId: 2548 |
Source: Process started | Author: Michael Haag, Florian Roth, juju4, oscd.community: Data: Command: wmic process call create "mshta C:\ProgramData\LZbir.rtf", CommandLine: wmic process call create "mshta C:\ProgramData\LZbir.rtf", CommandLine|base64offset|contains: h, Image: C:\Windows\System32\wbem\WMIC.exe, NewProcessName: C:\Windows\System32\wbem\WMIC.exe, OriginalFileName: C:\Windows\System32\wbem\WMIC.exe, ParentCommandLine: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding, ParentImage: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ParentProcessId: 2140, ProcessCommandLine: wmic process call create "mshta C:\ProgramData\LZbir.rtf", ProcessId: 2548 |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | Process created: C:\Windows\System32\wbem\WMIC.exe |
Source: unknown | TCP traffic detected without corresponding DNS query: 157.230.250.107 |
Source: unknown | TCP traffic detected without corresponding DNS query: 157.230.250.107 |
Source: unknown | TCP traffic detected without corresponding DNS query: 157.230.250.107 |
Source: unknown | TCP traffic detected without corresponding DNS query: 157.230.250.107 |
Source: unknown | TCP traffic detected without corresponding DNS query: 157.230.250.107 |
Source: EXCEL.EXE, 00000000.00000002.674598061.0000000005030000.00000002.00020000.sdmp, mshta.exe, 00000004.00000002.673378247.0000000003880000.00000002.00020000.sdmp | String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail) |
Source: mshta.exe, 00000004.00000002.672884822.0000000000473000.00000004.00000020.sdmp | String found in binary or memory: http://157.230.250.107:8 |
Source: mshta.exe, 00000004.00000002.672884822.0000000000473000.00000004.00000020.sdmp | String found in binary or memory: http://157.230.250.107:808 |
Source: mshta.exe, 00000004.00000002.672824147.00000000003BE000.00000004.00000020.sdmp | String found in binary or memory: http://157.230.250.107:8080/mfkrmotherfuckeru6y82sasswhoreh= |
Source: mshta.exe, 00000004.00000002.672824147.00000000003BE000.00000004.00000020.sdmp | String found in binary or memory: http://157.230.250.107:8080/mfkrmotherfuckeru6y82sasswhorehf |
Source: mshta.exe, 00000004.00000002.672824147.00000000003BE000.00000004.00000020.sdmp | String found in binary or memory: http://157.230.250.107:8080/mfkrmotherfuckeru6y82sasswhorehf9 |
Source: mshta.exe, 00000004.00000002.672824147.00000000003BE000.00000004.00000020.sdmp, mshta.exe, 00000004.00000002.672870442.0000000000431000.00000004.00000020.sdmp, mshta.exe, 00000004.00000002.673340911.0000000002DE5000.00000004.00000040.sdmp | String found in binary or memory: http://157.230.250.107:8080/mfkrmotherfuckeru6y82sasswhorehf9e |
Source: mshta.exe, 00000004.00000002.672824147.00000000003BE000.00000004.00000020.sdmp | String found in binary or memory: http://157.230.250.107:8080/mfkrmotherfuckeru6y82sasswhorehf9e$ |
Source: mshta.exe, 00000004.00000002.672824147.00000000003BE000.00000004.00000020.sdmp | String found in binary or memory: http://157.230.250.107:8080/mfkrmotherfuckeru6y82sasswhorehf9e/ |
Source: mshta.exe, 00000004.00000002.672884822.0000000000473000.00000004.00000020.sdmp | String found in binary or memory: http://157.230.250.10jec |
Source: mshta.exe, 00000004.00000002.672884822.0000000000473000.00000004.00000020.sdmp | String found in binary or memory: http://157.230.250.10ject |
Source: mshta.exe, 00000004.00000002.672884822.0000000000473000.00000004.00000020.sdmp | String found in binary or memory: http://157.230.250mObjec |
Source: EXCEL.EXE, 00000000.00000002.674598061.0000000005030000.00000002.00020000.sdmp, mshta.exe, 00000004.00000002.673378247.0000000003880000.00000002.00020000.sdmp | String found in binary or memory: http://investor.msn.com |
Source: EXCEL.EXE, 00000000.00000002.674598061.0000000005030000.00000002.00020000.sdmp, mshta.exe, 00000004.00000002.673378247.0000000003880000.00000002.00020000.sdmp | String found in binary or memory: http://investor.msn.com/ |
Source: EXCEL.EXE, 00000000.00000002.675120395.0000000005217000.00000002.00020000.sdmp, mshta.exe, 00000004.00000002.673674789.0000000003A67000.00000002.00020000.sdmp | String found in binary or memory: http://localizability/practices/XML.asp |
Source: EXCEL.EXE, 00000000.00000002.675120395.0000000005217000.00000002.00020000.sdmp, mshta.exe, 00000004.00000002.673674789.0000000003A67000.00000002.00020000.sdmp | String found in binary or memory: http://localizability/practices/XMLConfiguration.asp |
Source: EXCEL.EXE, 00000000.00000002.677319328.0000000006F70000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.677425971.0000000007886000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.677403930.0000000007166000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.677388652.0000000007136000.00000004.00000001.sdmp | String found in binary or memory: http://schemas.open |
Source: EXCEL.EXE, 00000000.00000002.677319328.0000000006F70000.00000004.00000001.sdmp | String found in binary or memory: http://schemas.openformatrg/package/2006/content-t |
Source: EXCEL.EXE, 00000000.00000002.677425971.0000000007886000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.677403930.0000000007166000.00000004.00000001.sdmp, EXCEL.EXE, 00000000.00000002.677388652.0000000007136000.00000004.00000001.sdmp | String found in binary or memory: http://schemas.openformatrg/package/2006/r |
Source: mshta.exe, 00000004.00000002.673916584.0000000003C60000.00000002.00020000.sdmp | String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous. |
Source: WMIC.exe, 00000002.00000002.414451673.0000000001C40000.00000002.00020000.sdmp | String found in binary or memory: http://servername/isapibackend.dll |
Source: EXCEL.EXE, 00000000.00000002.675120395.0000000005217000.00000002.00020000.sdmp, mshta.exe, 00000004.00000002.673674789.0000000003A67000.00000002.00020000.sdmp | String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check |
Source: EXCEL.EXE, 00000000.00000002.675120395.0000000005217000.00000002.00020000.sdmp, mshta.exe, 00000004.00000002.673674789.0000000003A67000.00000002.00020000.sdmp | String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true |
Source: mshta.exe, 00000004.00000002.673916584.0000000003C60000.00000002.00020000.sdmp | String found in binary or memory: http://www.%s.comPA |
Source: EXCEL.EXE, 00000000.00000002.674598061.0000000005030000.00000002.00020000.sdmp, mshta.exe, 00000004.00000002.673378247.0000000003880000.00000002.00020000.sdmp | String found in binary or memory: http://www.hotmail.com/oe |
Source: EXCEL.EXE, 00000000.00000002.675120395.0000000005217000.00000002.00020000.sdmp, mshta.exe, 00000004.00000002.673674789.0000000003A67000.00000002.00020000.sdmp | String found in binary or memory: http://www.icra.org/vocabulary/. |
Source: EXCEL.EXE, 00000000.00000002.674598061.0000000005030000.00000002.00020000.sdmp, mshta.exe, 00000004.00000002.673378247.0000000003880000.00000002.00020000.sdmp | String found in binary or memory: http://www.msnbc.com/news/ticker.txt |
Source: mshta.exe, 00000004.00000002.673378247.0000000003880000.00000002.00020000.sdmp | String found in binary or memory: http://www.windows.com/pctv. |
Source: C:\Windows\System32\mshta.exe | Window created: window name: CLIPBRDWNDCLASS |
Source: EXCEL.EXE, 00000000.00000002.677076109.0000000005ACD000.00000004.00000001.sdmp | Binary or memory string: C:\Windows\System32\Wbem;;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\C:\Windows\System32\Wbem\wmic.exewmic process call create "mshta \Registry\Machine\Software\Classes\Wow6432Node\CLSID\{00020423-0000-0000-C000-000000000046}423-0000-0000-C000-000000000046}\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeFP_NO_HOST_CHECK=NOHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCNUMBER_OF_PROCESSORS=4OS=Windows_NTPath=C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 85 Stepping 7, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=5507ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulem ~Z |
Source: C:\Windows\System32\mshta.exe | Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | Code function: 0_2_024E6743 |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | Code function: 0_2_024E6340 |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | Code function: 0_2_024E6753 |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | Code function: 0_2_024E66E8 |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | Code function: 0_2_024E66F3 |
Source: workbook.xml | Binary string: <workbook xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships"><fileVersion appName="xl" lastEdited="4" lowestEdited="4" rupBuild="4505"/><workbookPr defaultThemeVersion="124226"/><bookViews><workbookView xWindow="0" yWindow="30" windowWidth="19095" windowHeight="10230" firstSheet="1" activeTab="1"/></bookViews><sheets><sheet name="Macro1" sheetId="4" state="hidden" r:id="rId1"/><sheet name="Sheet1" sheetId="1" r:id="rId2"/></sheets><definedNames><definedName name="_xlnm.Auto_Open">Macro1!$V$1</definedName></definedNames><calcPr calcId="124519"/></workbook> |
Source: C:\Windows\System32\wbem\WMIC.exe | Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers |
Source: unknown | Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | Process created: C:\Windows\System32\wbem\WMIC.exe wmic process call create "mshta C:\ProgramData\LZbir.rtf" |
Source: unknown | Process created: C:\Windows\System32\mshta.exe mshta C:\ProgramData\LZbir.rtf |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | Process created: C:\Windows\System32\wbem\WMIC.exe wmic process call create "mshta C:\ProgramData\LZbir.rtf" |
Source: C:\Windows\System32\wbem\WMIC.exe | Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32 |
Source: C:\Windows\System32\wbem\WMIC.exe | WMI Queries: IWbemServices::ExecMethod - Win32_Process::Create |
Source: EXCEL.EXE, 00000000.00000002.674598061.0000000005030000.00000002.00020000.sdmp, mshta.exe, 00000004.00000002.673378247.0000000003880000.00000002.00020000.sdmp | Binary or memory string: .VBPud<_ |
Source: classification engine | Classification label: mal80.troj.expl.evad.winXLSM@4/6@0/1 |
Source: C:\Windows\System32\mshta.exe | Key opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings |
Source: 3762.xlsm | Initial sample: OLE zip file path = xl/media/image1.png |
Source: 3762.xlsm | Initial sample: OLE zip file path = docProps/custom.xml |
Source: 18430000.0.dr | Initial sample: OLE zip file path = xl/media/image1.png |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll |
Source: C:\Windows\System32\wbem\WMIC.exe | WMI Queries: IWbemServices::ExecMethod - Win32_Process::Create |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | Process created: cmd line: lzbir.rtf |
Source: unknown | Process created: cmd line: lzbir.rtf |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | Process information set: NOOPENFILEERRORBOX |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | Process information set: NOOPENFILEERRORBOX |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | Process information set: NOOPENFILEERRORBOX |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | Process information set: NOOPENFILEERRORBOX |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | Process information set: NOOPENFILEERRORBOX |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | Process information set: NOOPENFILEERRORBOX |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | Process information set: NOOPENFILEERRORBOX |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | Process information set: NOOPENFILEERRORBOX |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | Process information set: NOOPENFILEERRORBOX |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | Process information set: NOOPENFILEERRORBOX |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | Process information set: NOOPENFILEERRORBOX |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\wbem\WMIC.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\wbem\WMIC.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\mshta.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\mshta.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\mshta.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\wbem\WMIC.exe TID: 2908 | Thread sleep time: -180000s >= -30000s |
Source: C:\Windows\System32\mshta.exe TID: 2096 | Thread sleep time: -60000s >= -30000s |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | Code function: 0_2_024E6743 rdtsc |
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | Code function: 0_2_024E6743 rdtsc |
Source: EXCEL.EXE, 00000000.00000002.673077727.0000000000820000.00000002.00020000.sdmp, mshta.exe, 00000004.00000002.672950094.0000000001000000.00000002.00020000.sdmp | Binary or memory string: Shell_TrayWnd |
Source: EXCEL.EXE, 00000000.00000002.673077727.0000000000820000.00000002.00020000.sdmp, mshta.exe, 00000004.00000002.672950094.0000000001000000.00000002.00020000.sdmp | Binary or memory string: !Progman |
Source: EXCEL.EXE, 00000000.00000002.673077727.0000000000820000.00000002.00020000.sdmp, mshta.exe, 00000004.00000002.672950094.0000000001000000.00000002.00020000.sdmp | Binary or memory string: Program Manager< |
Source: C:\Windows\System32\mshta.exe | Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation |
Source: C:\Windows\System32\mshta.exe | Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation |
Source: C:\Windows\System32\wbem\WMIC.exe | Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid |
Thumbnails
This section contains all screenshots as thumbnails, including those not shown in the slideshow.