Files
File Path
|
Type
|
Category
|
Malicious
|
|
---|---|---|---|---|
PO 65738963578 Revise Settlement.xlsx
|
CDFV2 Encrypted
|
initial sample
|
||
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\BUSY[1].exe
|
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
|
downloaded
|
||
C:\Users\user\AppData\Local\Temp\idcqz.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
||
C:\Users\user\Desktop\~$PO 65738963578 Revise Settlement.xlsx
|
data
|
dropped
|
||
C:\Users\Public\vbc.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\3BF36CD9.wmf
|
ms-windows metafont .wmf
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\5CBD0238.wmf
|
ms-windows metafont .wmf
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\5D623D4F.wmf
|
ms-windows metafont .wmf
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\A9EBFD06.wmf
|
ms-windows metafont .wmf
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\D8559C53.emf
|
Windows Enhanced Metafile (EMF) image data version 0x10000
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\bn5z71pvulub10vjar
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\dknqrab
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\nswAB85.tmp
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\~DF676A4AF24BE52768.TMP
|
CDFV2 Encrypted
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\~DF6A1E229B1B4407B7.TMP
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\~DFCE6EE0378A984A97.TMP
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\~DFEB8550F8DC457C8E.TMP
|
data
|
dropped
|
There are 7 hidden files, click here to show them.
Processes
Path
|
Cmdline
|
Malicious
|
|
---|---|---|---|
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
|
"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
|
||
C:\Users\Public\vbc.exe
|
"C:\Users\Public\vbc.exe"
|
||
C:\Users\user\AppData\Local\Temp\idcqz.exe
|
C:\Users\user\AppData\Local\Temp\idcqz.exe C:\Users\user\AppData\Local\Temp\dknqrab
|
||
C:\Users\user\AppData\Local\Temp\idcqz.exe
|
C:\Users\user\AppData\Local\Temp\idcqz.exe C:\Users\user\AppData\Local\Temp\dknqrab
|
||
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
|
URLs
Name
|
IP
|
Malicious
|
|
---|---|---|---|
www.cortesdisenosroutercnc.com/itq4/
|
|||
http://198.12.81.20/busy/BUSY.exeC:
|
unknown
|
||
http://198.12.81.20/busy/BUSY.exeiiC:
|
unknown
|
||
http://198.12.81.20/busy/BUSY.exej
|
unknown
|
||
http://198.12.81.20/busy/BUSY.exe
|
198.12.81.20
|
||
http://nsis.sf.net/NSIS_ErrorError
|
unknown
|
IPs
IP
|
Domain
|
Country
|
Malicious
|
|
---|---|---|---|---|
198.12.81.20
|
unknown
|
United States
|
Registry
Path
|
Value
|
Malicious
|
|
---|---|---|---|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
|
q/2
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel
|
MTTT
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\ReviewCycle
|
ReviewToken
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\6690F
|
6690F
|
||
HKEY_CURRENT_USER\Software\Microsoft\GDIPlus
|
FontCachePath
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
|
VBAFiles
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
|
b>2
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\6BBE0
|
6BBE0
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\6DC1C
|
6DC1C
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Place MRU
|
Max Display
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Place MRU
|
Item 1
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Max Display
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 1
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 2
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 3
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 4
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 5
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 6
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 7
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 8
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 9
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 10
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 11
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 12
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 13
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 14
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 15
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 16
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 17
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 18
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 19
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 20
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
|
Item 21
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Security\Trusted Documents
|
LastPurgeTime
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
|
1033
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
|
1033
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
|
EXCELFiles
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
|
ProductFiles
|
||
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\6BBE0
|
6BBE0
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109E60090400100000000F01FEC\Usage
|
EquationEditorFilesIntl_1033
|
||
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
|
SavedLegacySettings
|
There are 31 hidden registries, click here to show them.
Memdumps
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
---|---|---|---|---|
160000
|
direct allocation
|
page read and write
|
||
40A000
|
unkown
|
page read and write
|
||
7D3F000
|
trusted library allocation
|
page read and write
|
||
782000
|
unkown
|
page read and write
|
||
408000
|
unkown
|
page readonly
|
||
408000
|
unkown
|
page readonly
|
||
8F4000
|
heap
|
page read and write
|
||
3AE000
|
stack
|
page read and write
|
||
400000
|
unkown
|
page readonly
|
||
28FF000
|
stack
|
page read and write
|
||
320000
|
heap
|
page read and write
|
||
31E000
|
stack
|
page read and write
|
||
8FF000
|
heap
|
page read and write
|
||
110000
|
direct allocation
|
page execute and read and write
|
||
65C000
|
stack
|
page read and write
|
||
242F000
|
stack
|
page read and write
|
||
2BEF000
|
stack
|
page read and write
|
||
969000
|
heap
|
page read and write
|
||
B67000
|
unkown
|
page readonly
|
||
1F30000
|
direct allocation
|
page read and write
|
||
378F000
|
stack
|
page read and write
|
||
84FD000
|
stack
|
page read and write
|
||
B67000
|
unkown
|
page readonly
|
||
B5E000
|
unkown
|
page readonly
|
||
9A5000
|
heap
|
page read and write
|
||
B50000
|
unkown
|
page readonly
|
||
40A000
|
unkown
|
page write copy
|
||
B50000
|
unkown
|
page readonly
|
||
7C0000
|
trusted library allocation
|
page read and write
|
||
B50000
|
unkown
|
page readonly
|
||
2C3D000
|
stack
|
page read and write
|
||
2320000
|
heap
|
page read and write
|
||
408000
|
unkown
|
page readonly
|
||
408000
|
unkown
|
page readonly
|
||
401000
|
unkown
|
page execute read
|
||
7B9000
|
unkown
|
page readonly
|
||
788000
|
unkown
|
page read and write
|
||
2A0000
|
heap
|
page read and write
|
||
10000
|
heap
|
page read and write
|
||
993000
|
heap
|
page read and write
|
||
B51000
|
unkown
|
page execute read
|
||
B63000
|
unkown
|
page write copy
|
||
B51000
|
unkown
|
page execute read
|
||
82C3000
|
heap
|
page read and write
|
||
400000
|
unkown
|
page readonly
|
||
B50000
|
unkown
|
page readonly
|
||
7B9000
|
unkown
|
page readonly
|
||
995000
|
heap
|
page read and write
|
||
401000
|
unkown
|
page execute read
|
||
400000
|
unkown
|
page readonly
|
||
83FE000
|
stack
|
page read and write
|
||
2C7E000
|
stack
|
page read and write
|
||
B67000
|
unkown
|
page readonly
|
||
2F0000
|
heap
|
page read and write
|
||
7B9000
|
unkown
|
page readonly
|
||
B63000
|
unkown
|
page write copy
|
||
B50000
|
unkown
|
page readonly
|
||
9AC000
|
heap
|
page read and write
|
||
2BF0000
|
trusted library allocation
|
page read and write
|
||
18A000
|
stack
|
page read and write
|
||
670000
|
heap
|
page read and write
|
||
98D000
|
heap
|
page read and write
|
||
955000
|
heap
|
page read and write
|
||
2CBD000
|
stack
|
page read and write
|
||
7B5000
|
unkown
|
page read and write
|
||
27F000
|
stack
|
page read and write
|
||
1EF9000
|
trusted library section
|
page readonly
|
||
36D000
|
stack
|
page read and write
|
||
7A6000
|
unkown
|
page read and write
|
||
BE6000
|
heap
|
page read and write
|
||
B51000
|
unkown
|
page execute read
|
||
400000
|
unkown
|
page readonly
|
||
40A000
|
unkown
|
page write copy
|
||
970000
|
heap
|
page read and write
|
||
750000
|
heap
|
page read and write
|
||
252F000
|
stack
|
page read and write
|
||
1EFF000
|
trusted library section
|
page readonly
|
||
B51000
|
unkown
|
page execute read
|
||
920000
|
heap
|
page read and write
|
||
B63000
|
unkown
|
page write copy
|
||
B63000
|
unkown
|
page write copy
|
||
927000
|
heap
|
page read and write
|
||
7D2F000
|
trusted library allocation
|
page read and write
|
||
401000
|
unkown
|
page execute read
|
||
B50000
|
unkown
|
page readonly
|
||
B5E000
|
unkown
|
page readonly
|
||
7D00000
|
trusted library allocation
|
page read and write
|
||
8BE000
|
stack
|
page read and write
|
||
82C0000
|
heap
|
page read and write
|
||
2A00000
|
trusted library allocation
|
page read and write
|
||
2D2B000
|
heap
|
page read and write
|
||
950000
|
heap
|
page read and write
|
||
8670000
|
trusted library allocation
|
page read and write
|
||
2BF0000
|
trusted library allocation
|
page read and write
|
||
3DE000
|
stack
|
page read and write
|
||
2BF0000
|
trusted library allocation
|
page read and write
|
||
95A000
|
heap
|
page read and write
|
||
534000
|
unkown
|
page read and write
|
||
29FF000
|
stack
|
page read and write
|
||
408000
|
unkown
|
page readonly
|
||
8B000
|
stack
|
page read and write
|
||
3790000
|
trusted library allocation
|
page read and write
|
||
BE0000
|
heap
|
page read and write
|
||
B51000
|
unkown
|
page execute read
|
||
866F000
|
stack
|
page read and write
|
||
B50000
|
unkown
|
page readonly
|
||
B5E000
|
unkown
|
page readonly
|
||
7E3C000
|
stack
|
page read and write
|
||
89000
|
stack
|
page read and write
|
||
B67000
|
unkown
|
page readonly
|
||
931000
|
heap
|
page read and write
|
||
B63000
|
unkown
|
page write copy
|
||
B5E000
|
unkown
|
page readonly
|
||
3E0000
|
heap
|
page read and write
|
||
786000
|
unkown
|
page read and write
|
||
B5E000
|
unkown
|
page readonly
|
||
7D44000
|
trusted library allocation
|
page read and write
|
||
8140000
|
heap
|
page read and write
|
||
970000
|
heap
|
page read and write
|
||
2A0000
|
heap
|
page read and write
|
||
B63000
|
unkown
|
page write copy
|
||
B67000
|
unkown
|
page readonly
|
||
8D0000
|
heap
|
page read and write
|
||
1EF0000
|
trusted library section
|
page readonly
|
||
99E000
|
heap
|
page read and write
|
||
10000
|
heap
|
page read and write
|
||
B5E000
|
unkown
|
page readonly
|
||
969000
|
heap
|
page read and write
|
||
993000
|
heap
|
page read and write
|
||
40A000
|
unkown
|
page write copy
|
||
800D000
|
stack
|
page read and write
|
||
2C2000
|
heap
|
page read and write
|
||
2CF0000
|
heap
|
page read and write
|
||
B50000
|
unkown
|
page readonly
|
||
40A000
|
unkown
|
page write copy
|
||
B67000
|
unkown
|
page readonly
|
||
950000
|
heap
|
page read and write
|
||
944000
|
heap
|
page read and write
|
||
2F4000
|
heap
|
page read and write
|
||
401000
|
unkown
|
page execute read
|
||
517000
|
unkown
|
page read and write
|
||
8D7000
|
heap
|
page read and write
|
||
2A4000
|
heap
|
page read and write
|
||
7E7F000
|
stack
|
page read and write
|
||
401000
|
unkown
|
page execute read
|
||
B51000
|
unkown
|
page execute read
|
||
15C000
|
stack
|
page read and write
|
||
2CFE000
|
stack
|
page read and write
|
||
10000
|
heap
|
page read and write
|
||
B51000
|
unkown
|
page execute read
|
||
7ED0000
|
heap
|
page read and write
|
||
B5E000
|
unkown
|
page readonly
|
||
92F000
|
heap
|
page read and write
|
||
77C000
|
unkown
|
page read and write
|
||
510000
|
unkown
|
page read and write
|
||
32C000
|
stack
|
page read and write
|
||
2D20000
|
heap
|
page read and write
|
||
7B9000
|
unkown
|
page readonly
|
||
400000
|
unkown
|
page readonly
|
||
98D000
|
heap
|
page read and write
|
||
220000
|
heap
|
page read and write
|
||
2D28000
|
heap
|
page read and write
|
||
312000
|
heap
|
page read and write
|
||
87E0000
|
heap
|
page read and write
|
||
2A7000
|
heap
|
page read and write
|
||
2ED000
|
stack
|
page read and write
|
||
401000
|
unkown
|
page execute read
|
||
400000
|
unkown
|
page readonly
|
||
40C000
|
unkown
|
page read and write
|
||
7D1D000
|
trusted library allocation
|
page read and write
|
||
810F000
|
stack
|
page read and write
|
||
7B9000
|
unkown
|
page readonly
|
||
2D24000
|
heap
|
page read and write
|
||
B63000
|
unkown
|
page read and write
|
||
40A000
|
unkown
|
page write copy
|
||
1F20000
|
heap
|
page read and write
|
||
7D21000
|
trusted library allocation
|
page read and write
|
||
18C000
|
stack
|
page read and write
|
||
8670000
|
trusted library allocation
|
page read and write
|
||
B67000
|
unkown
|
page readonly
|
||
1EEE000
|
stack
|
page read and write
|
||
B67000
|
unkown
|
page readonly
|
||
408000
|
unkown
|
page readonly
|
||
B51000
|
unkown
|
page execute read
|
||
1EF4000
|
trusted library section
|
page readonly
|
||
8560000
|
heap
|
page read and write
|
||
8670000
|
trusted library allocation
|
page read and write
|
||
B63000
|
unkown
|
page write copy
|
||
827D000
|
stack
|
page read and write
|
||
3D0000
|
heap
|
page read and write
|
||
7B9000
|
unkown
|
page readonly
|
||
2AEF000
|
stack
|
page read and write
|
||
B5E000
|
unkown
|
page readonly
|
||
970000
|
heap
|
page read and write
|
There are 184 hidden memdumps, click here to show them.