IOC Report
PO 65738963578 Revise Settlement.xlsx

loading gif

Files

File Path
Type
Category
Malicious
PO 65738963578 Revise Settlement.xlsx
CDFV2 Encrypted
initial sample
malicious
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\BUSY[1].exe
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
downloaded
malicious
C:\Users\user\AppData\Local\Temp\idcqz.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
malicious
C:\Users\user\Desktop\~$PO 65738963578 Revise Settlement.xlsx
data
dropped
malicious
C:\Users\Public\vbc.exe
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
dropped
malicious
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\3BF36CD9.wmf
ms-windows metafont .wmf
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\5CBD0238.wmf
ms-windows metafont .wmf
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\5D623D4F.wmf
ms-windows metafont .wmf
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\A9EBFD06.wmf
ms-windows metafont .wmf
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\D8559C53.emf
Windows Enhanced Metafile (EMF) image data version 0x10000
dropped
C:\Users\user\AppData\Local\Temp\bn5z71pvulub10vjar
data
dropped
C:\Users\user\AppData\Local\Temp\dknqrab
data
dropped
C:\Users\user\AppData\Local\Temp\nswAB85.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\~DF676A4AF24BE52768.TMP
CDFV2 Encrypted
dropped
C:\Users\user\AppData\Local\Temp\~DF6A1E229B1B4407B7.TMP
data
dropped
C:\Users\user\AppData\Local\Temp\~DFCE6EE0378A984A97.TMP
data
dropped
C:\Users\user\AppData\Local\Temp\~DFEB8550F8DC457C8E.TMP
data
dropped
There are 7 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
malicious
C:\Users\Public\vbc.exe
"C:\Users\Public\vbc.exe"
malicious
C:\Users\user\AppData\Local\Temp\idcqz.exe
C:\Users\user\AppData\Local\Temp\idcqz.exe C:\Users\user\AppData\Local\Temp\dknqrab
malicious
C:\Users\user\AppData\Local\Temp\idcqz.exe
C:\Users\user\AppData\Local\Temp\idcqz.exe C:\Users\user\AppData\Local\Temp\dknqrab
malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding

URLs

Name
IP
Malicious
www.cortesdisenosroutercnc.com/itq4/
malicious
http://198.12.81.20/busy/BUSY.exeC:
unknown
malicious
http://198.12.81.20/busy/BUSY.exeiiC:
unknown
malicious
http://198.12.81.20/busy/BUSY.exej
unknown
malicious
http://198.12.81.20/busy/BUSY.exe
198.12.81.20
malicious
http://nsis.sf.net/NSIS_ErrorError
unknown

IPs

IP
Domain
Country
Malicious
198.12.81.20
unknown
United States
malicious

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
q/2
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel
MTTT
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\ReviewCycle
ReviewToken
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\6690F
6690F
HKEY_CURRENT_USER\Software\Microsoft\GDIPlus
FontCachePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
VBAFiles
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
b>2
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\6BBE0
6BBE0
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\6DC1C
6DC1C
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Place MRU
Max Display
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Place MRU
Item 1
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Max Display
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 1
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 2
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 3
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 4
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 5
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 6
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 7
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 8
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 9
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 10
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 11
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 12
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 13
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 14
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 15
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 16
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 17
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 18
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 19
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 20
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 21
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Security\Trusted Documents
LastPurgeTime
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
1033
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
EXCELFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
ProductFiles
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\6BBE0
6BBE0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109E60090400100000000F01FEC\Usage
EquationEditorFilesIntl_1033
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
SavedLegacySettings
There are 31 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
160000
direct allocation
page read and write
malicious
40A000
unkown
page read and write
7D3F000
trusted library allocation
page read and write
782000
unkown
page read and write
408000
unkown
page readonly
408000
unkown
page readonly
8F4000
heap
page read and write
3AE000
stack
page read and write
400000
unkown
page readonly
28FF000
stack
page read and write
320000
heap
page read and write
31E000
stack
page read and write
8FF000
heap
page read and write
110000
direct allocation
page execute and read and write
65C000
stack
page read and write
242F000
stack
page read and write
2BEF000
stack
page read and write
969000
heap
page read and write
B67000
unkown
page readonly
1F30000
direct allocation
page read and write
378F000
stack
page read and write
84FD000
stack
page read and write
B67000
unkown
page readonly
B5E000
unkown
page readonly
9A5000
heap
page read and write
B50000
unkown
page readonly
40A000
unkown
page write copy
B50000
unkown
page readonly
7C0000
trusted library allocation
page read and write
B50000
unkown
page readonly
2C3D000
stack
page read and write
2320000
heap
page read and write
408000
unkown
page readonly
408000
unkown
page readonly
401000
unkown
page execute read
7B9000
unkown
page readonly
788000
unkown
page read and write
2A0000
heap
page read and write
10000
heap
page read and write
993000
heap
page read and write
B51000
unkown
page execute read
B63000
unkown
page write copy
B51000
unkown
page execute read
82C3000
heap
page read and write
400000
unkown
page readonly
B50000
unkown
page readonly
7B9000
unkown
page readonly
995000
heap
page read and write
401000
unkown
page execute read
400000
unkown
page readonly
83FE000
stack
page read and write
2C7E000
stack
page read and write
B67000
unkown
page readonly
2F0000
heap
page read and write
7B9000
unkown
page readonly
B63000
unkown
page write copy
B50000
unkown
page readonly
9AC000
heap
page read and write
2BF0000
trusted library allocation
page read and write
18A000
stack
page read and write
670000
heap
page read and write
98D000
heap
page read and write
955000
heap
page read and write
2CBD000
stack
page read and write
7B5000
unkown
page read and write
27F000
stack
page read and write
1EF9000
trusted library section
page readonly
36D000
stack
page read and write
7A6000
unkown
page read and write
BE6000
heap
page read and write
B51000
unkown
page execute read
400000
unkown
page readonly
40A000
unkown
page write copy
970000
heap
page read and write
750000
heap
page read and write
252F000
stack
page read and write
1EFF000
trusted library section
page readonly
B51000
unkown
page execute read
920000
heap
page read and write
B63000
unkown
page write copy
B63000
unkown
page write copy
927000
heap
page read and write
7D2F000
trusted library allocation
page read and write
401000
unkown
page execute read
B50000
unkown
page readonly
B5E000
unkown
page readonly
7D00000
trusted library allocation
page read and write
8BE000
stack
page read and write
82C0000
heap
page read and write
2A00000
trusted library allocation
page read and write
2D2B000
heap
page read and write
950000
heap
page read and write
8670000
trusted library allocation
page read and write
2BF0000
trusted library allocation
page read and write
3DE000
stack
page read and write
2BF0000
trusted library allocation
page read and write
95A000
heap
page read and write
534000
unkown
page read and write
29FF000
stack
page read and write
408000
unkown
page readonly
8B000
stack
page read and write
3790000
trusted library allocation
page read and write
BE0000
heap
page read and write
B51000
unkown
page execute read
866F000
stack
page read and write
B50000
unkown
page readonly
B5E000
unkown
page readonly
7E3C000
stack
page read and write
89000
stack
page read and write
B67000
unkown
page readonly
931000
heap
page read and write
B63000
unkown
page write copy
B5E000
unkown
page readonly
3E0000
heap
page read and write
786000
unkown
page read and write
B5E000
unkown
page readonly
7D44000
trusted library allocation
page read and write
8140000
heap
page read and write
970000
heap
page read and write
2A0000
heap
page read and write
B63000
unkown
page write copy
B67000
unkown
page readonly
8D0000
heap
page read and write
1EF0000
trusted library section
page readonly
99E000
heap
page read and write
10000
heap
page read and write
B5E000
unkown
page readonly
969000
heap
page read and write
993000
heap
page read and write
40A000
unkown
page write copy
800D000
stack
page read and write
2C2000
heap
page read and write
2CF0000
heap
page read and write
B50000
unkown
page readonly
40A000
unkown
page write copy
B67000
unkown
page readonly
950000
heap
page read and write
944000
heap
page read and write
2F4000
heap
page read and write
401000
unkown
page execute read
517000
unkown
page read and write
8D7000
heap
page read and write
2A4000
heap
page read and write
7E7F000
stack
page read and write
401000
unkown
page execute read
B51000
unkown
page execute read
15C000
stack
page read and write
2CFE000
stack
page read and write
10000
heap
page read and write
B51000
unkown
page execute read
7ED0000
heap
page read and write
B5E000
unkown
page readonly
92F000
heap
page read and write
77C000
unkown
page read and write
510000
unkown
page read and write
32C000
stack
page read and write
2D20000
heap
page read and write
7B9000
unkown
page readonly
400000
unkown
page readonly
98D000
heap
page read and write
220000
heap
page read and write
2D28000
heap
page read and write
312000
heap
page read and write
87E0000
heap
page read and write
2A7000
heap
page read and write
2ED000
stack
page read and write
401000
unkown
page execute read
400000
unkown
page readonly
40C000
unkown
page read and write
7D1D000
trusted library allocation
page read and write
810F000
stack
page read and write
7B9000
unkown
page readonly
2D24000
heap
page read and write
B63000
unkown
page read and write
40A000
unkown
page write copy
1F20000
heap
page read and write
7D21000
trusted library allocation
page read and write
18C000
stack
page read and write
8670000
trusted library allocation
page read and write
B67000
unkown
page readonly
1EEE000
stack
page read and write
B67000
unkown
page readonly
408000
unkown
page readonly
B51000
unkown
page execute read
1EF4000
trusted library section
page readonly
8560000
heap
page read and write
8670000
trusted library allocation
page read and write
B63000
unkown
page write copy
827D000
stack
page read and write
3D0000
heap
page read and write
7B9000
unkown
page readonly
2AEF000
stack
page read and write
B5E000
unkown
page readonly
970000
heap
page read and write
There are 184 hidden memdumps, click here to show them.