Automated Malware Analysis IOC Report for

Files

File Path

Type

Processes

Path

Cmdline

Malicious

C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding

C:\Users\user\AppData\Roaming\plugmancdht5461.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\ZdNnwVcb.exe

C:\Windows\SysWOW64\schtasks.exe

C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZdNnwVcb" /XML "C:\Users\user\AppData\Local\Temp\tmp41F1.tmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

C:\Windows\SysWOW64\schtasks.exe

schtasks.exe" /create /f /tn "SMTP Service" /xml "C:\Users\user\AppData\Local\Temp\tmpA9E2.tmp

C:\Windows\SysWOW64\schtasks.exe

schtasks.exe" /create /f /tn "SMTP Service Task" /xml "C:\Users\user\AppData\Local\Temp\tmp9E5E.tmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe 0

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding

C:\Windows\System32\taskeng.exe

taskeng.exe {AC07D2CB-425B-43FA-983F-3B14071F638D} S-1-5-21-966771315-3019405637-367336477-1006:user-PC\user:Interactive:[1]

C:\Program Files (x86)\SMTP Service\smtpsvc.exe

"C:\Program Files (x86)\SMTP Service\smtpsvc.exe" 0

C:\Program Files (x86)\SMTP Service\smtpsvc.exe

"C:\Program Files (x86)\SMTP Service\smtpsvc.exe"

There are 2 hidden processes, click here to show them.

URLs

Name

Malicious

http://paxz.tk/plugmanzx.exe

2.58.149.41

Details

Name:	http://paxz.tk/plugmanzx.exe
IP:	2.58.149.41
TargetID:	2
From Memory:	false
Current Path:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Source:	network

Signature Hits	Behavior Group	Mitre Attack
Antivirus detection for URL or domain	AV Detection
Sigma detected: EQNEDT32.EXE connecting to internet	Exploits
IP address seen in connection with other malware	Networking
Potential document exploit detected (performs HTTP gets)	Software Vulnerabilities	Exploitation for Client Execution
Potential document exploit detected (unknown TCP traffic)	Software Vulnerabilities	Exploitation for Client Execution

4,0,419161966,0000000000099000,00000104,00000010,00020000,00000000,1,0

vijayikohli1.bounceme.net

Details

Name:	vijayikohli1.bounceme.net
TargetID:	0
From Memory:	false
Current Path:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Source:	config extactor

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol

127.0.0.1

Details

Name:	127.0.0.1
TargetID:	0
From Memory:	false
Current Path:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Source:	config extactor

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol

http://google.com

unknown

Details

Name:	http://google.com
TargetID:	9
From Memory:	true
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	RegSvcs.exe, 00000009.00000002.691048568.000000000266B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000009.00000002.692555556.00000000039B6000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000009.00000002.691799150.0000000003770000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000009.00000002.690909965.0000000000D80000.00000004.08000000.00040000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

unknown

Details

Name:	http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
TargetID:	4
From Memory:	true
Current Path:	C:\Users\user\AppData\Roaming\plugmancdht5461.exe
Source:	plugmancdht5461.exe, 00000004.00000002.433210954.00000000024B4000.00000004.00000800.00020000.00000000.sdmp, plugmancdht5461.exe, 00000004.00000002.433106476.0000000002441000.00000004.00000800.00020000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Domains

Name

Malicious

paxz.tk

2.58.149.41

Details

Name:	paxz.tk
IP:	2.58.149.41
TargetID:	2
Current Path:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: EQNEDT32.EXE connecting to internet	Exploits
Potential document exploit detected (performs DNS queries)	Software Vulnerabilities	Exploitation for Client Execution
Potential document exploit detected (performs HTTP gets)	Software Vulnerabilities	Exploitation for Client Execution
Potential document exploit detected (unknown TCP traffic)	Software Vulnerabilities	Exploitation for Client Execution
Uses a known web browser user agent for HTTP communication	Networking	Application Layer Protocol
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

vijayikohli1.bounceme.net

103.153.78.234

Details

Name:	vijayikohli1.bounceme.net
IP:	103.153.78.234
TargetID:	9
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)	Networking
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port

IPs

Domain

Country

Malicious

103.153.78.234

vijayikohli1.bounceme.net

unknown

Details

IP:	103.153.78.234
TargetID:	9
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
ASN number:	134687
ASN name:	TWIDC-AS-APTWIDCLimitedHK
Private:	false
Domain:	vijayikohli1.bounceme.net

Signature Hits	Behavior Group	Mitre Attack
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)	Networking
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port

2.58.149.41

paxz.tk

Netherlands

Details

IP:	2.58.149.41
TargetID:	2
Current Path:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Country:	Netherlands
Countrycode:	NLD
ASN number:	395800
ASN name:	GBTCLOUDUS
Private:	false
Domain:	paxz.tk

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: EQNEDT32.EXE connecting to internet	Exploits
Potential document exploit detected (performs HTTP gets)	Software Vulnerabilities	Exploitation for Client Execution
Potential document exploit detected (unknown TCP traffic)	Software Vulnerabilities	Exploitation for Client Execution

Registry

Path

Value

Malicious

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

*k,

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word

MTTT

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

?o,

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

5x,

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\ReviewCycle

ReviewToken

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\DocumentRecovery\2FB21

2FB21

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage

VBAFiles