IOC Report
documentazione 68668.xls

loading gif

Files

File Path
Type
Category
Malicious
documentazione 68668.xls
Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Author: Dream, Last Saved By: TYHRETH, Name of Creating Application: Microsoft Excel, Create Time/Date: Fri Jun 5 19:19:34 2015, Last Saved Time/Date: Wed Jun 8 07:41:36 2022, Security: 0
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\UVvnppK[1].dll
PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
downloaded
 malicious
C:\Users\user\Desktop\documentazione 68668.xls
Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Author: Dream, Last Saved By: TYHRETH, Name of Creating Application: Microsoft Excel, Create Time/Date: Fri Jun 5 19:19:34 2015, Last Saved Time/Date: Wed Jun 8 07:41:36 2022, Security: 0
dropped
 malicious
C:\Users\user\wdusx2.ocx
PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
dropped
 malicious
C:\Windows\System32\LxvynAbdjmnUIIL\BlVTVcJlqYTKwC.dll (copy)
PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
dropped
 malicious
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
Microsoft Cabinet archive data, 61712 bytes, 1 file
dropped
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\Rea3Iu3wGvgAbTset0[1].htm
HTML document, ASCII text, with very long lines
downloaded
C:\Users\user\AppData\Local\Temp\242.tmp
Composite Document File V2 Document, Cannot read section info
dropped
C:\Users\user\AppData\Local\Temp\Cab806.tmp
Microsoft Cabinet archive data, 61712 bytes, 1 file
dropped
C:\Users\user\AppData\Local\Temp\Tar807.tmp
data
modified
C:\Users\user\AppData\Local\Temp\~DFA00266093586698C.TMP
data
dropped
C:\Users\user\AppData\Local\Temp\~DFEE5B54DDC882DEE7.TMP
data
dropped
C:\Users\user\wdusx3.ocx
HTML document, ASCII text, with very long lines
dropped
There are 4 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
 malicious
C:\Windows\System32\regsvr32.exe
C:\Windows\System32\regsvr32.exe /S ..\wdusx1.ocx
 malicious
C:\Windows\System32\regsvr32.exe
C:\Windows\System32\regsvr32.exe /S ..\wdusx2.ocx
 malicious
C:\Windows\System32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\LxvynAbdjmnUIIL\BlVTVcJlqYTKwC.dll"
 malicious
C:\Windows\System32\regsvr32.exe
C:\Windows\System32\regsvr32.exe /S ..\wdusx3.ocx
 malicious
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup

URLs

Name
IP
Malicious
http://kronostr.com/tr/68yHRhfuU7Qj/
188.132.217.108
 malicious
https://www.zardamarine.com/images/psQbAjrrEOXWPrS/
208.67.23.91
 malicious
http://labfitouts.com/cgi-bin/Rea3Iu3wGvgAbTset0/
66.96.149.19
 malicious
https://198.199.70.22/B
unknown
 malicious
https://165.22.254.68/O
unknown
 malicious
https://198.199.70.22/080/F
unknown
 malicious
https://198.199.70.22:8080/e
unknown
 malicious
https://198.199.70.22:8080/a
unknown
 malicious
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
unknown
http://crl.entrust.net/server1.crl0
unknown
http://ocsp.entrust.net03
unknown
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
unknown
http://www.diginotar.nl/cps/pkioverheid0
unknown
http://ocsp.entrust.net0D
unknown
https://secure.comodo.com/CPS0
unknown
https://165.22.254.68/
unknown
http://crl.entrust.net/2048ca.crl0
unknown
There are 7 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
zardamarine.com
208.67.23.91
 malicious
www.zardamarine.com
unknown
 malicious
labfitouts.com
66.96.149.19
kronostr.com
188.132.217.108

IPs

IP
Domain
Country
Malicious
157.245.111.0
unknown
United States
malicious
157.230.99.206
unknown
United States
malicious
54.37.106.167
unknown
France
malicious
196.44.98.190
unknown
Ghana
malicious
59.148.253.194
unknown
Hong Kong
malicious
202.29.239.162
unknown
Thailand
malicious
103.41.204.169
unknown
Indonesia
malicious
36.67.23.59
unknown
Indonesia
malicious
165.22.254.68
unknown
United States
malicious
103.56.149.105
unknown
Indonesia
malicious
85.214.67.203
unknown
Germany
malicious
68.183.91.111
unknown
United States
malicious
85.25.120.45
unknown
Germany
malicious
198.199.70.22
unknown
United States
malicious
93.104.209.107
unknown
Germany
malicious
208.67.23.91
zardamarine.com
United States
malicious
188.225.32.231
unknown
Russian Federation
malicious
175.126.176.79
unknown
Korea Republic of
malicious
139.196.72.155
unknown
China
malicious
165.232.185.110
unknown
United States
malicious
104.248.225.227
unknown
United States
malicious
103.126.216.86
unknown
Bangladesh
malicious
128.199.217.206
unknown
United Kingdom
malicious
116.124.128.206
unknown
Korea Republic of
malicious
103.224.241.74
unknown
India
malicious
103.71.99.57
unknown
India
malicious
210.57.209.142
unknown
Indonesia
malicious
202.28.34.99
unknown
Thailand
malicious
87.106.97.83
unknown
Germany
malicious
103.254.12.236
unknown
Viet Nam
malicious
103.85.95.4
unknown
Indonesia
malicious
54.37.228.122
unknown
France
malicious
202.134.4.210
unknown
Indonesia
malicious
88.217.172.165
unknown
Germany
malicious
195.77.239.39
unknown
Spain
malicious
165.22.254.236
unknown
United States
malicious
78.47.204.80
unknown
Germany
malicious
118.98.72.86
unknown
Indonesia
malicious
104.244.79.94
unknown
United States
malicious
37.44.244.177
unknown
Germany
malicious
178.62.112.199
unknown
European Union
malicious
62.171.178.147
unknown
United Kingdom
malicious
64.227.55.231
unknown
United States
malicious
188.132.217.108
kronostr.com
Turkey
66.96.149.19
labfitouts.com
United States
There are 35 hidden IPs, click here to show them.

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
d.2
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel
MTTT
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\ReviewCycle
ReviewToken
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\661DE
661DE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
VBAFiles
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
-#2
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Place MRU
Max Display
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Max Display
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 1
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 2
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 3
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 4
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 5
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 6
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 7
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 8
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 9
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 10
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 11
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 12
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 13
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 14
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 15
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 16
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 17
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 18
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 19
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 20
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\70A3D
70A3D
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Place MRU
Max Display
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Max Display
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 1
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 2
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 3
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 4
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 5
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 6
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 7
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 8
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 9
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 10
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 11
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 12
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 13
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 14
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 15
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 16
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 17
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 18
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 19
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 20
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\71084
71084
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Security\Trusted Documents
LastPurgeTime
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
1033
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
EXCELFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
ProductFiles
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
SavedLegacySettings
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C
Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C
Blob
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
SavedLegacySettings
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C
Blob
There are 57 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
3AA000
heap
page read and write
 malicious
180001000
direct allocation
page execute read
 malicious
180001000
direct allocation
page execute read
 malicious
4B0000
direct allocation
page execute and read and write
 malicious
140000
direct allocation
page execute and read and write
 malicious
2D01000
heap
page read and write
34B000
heap
page read and write
20F0000
heap
page read and write
1C0000
heap
page read and write
1FE000
heap
page read and write
2CFC000
heap
page read and write
33DF000
heap
page read and write
28F0000
heap
page read and write
61A04000
unkown
page read and write
222B000
heap
page read and write
2AA2000
heap
page read and write
2CF4000
heap
page read and write
2CE4000
heap
page read and write
10000
heap
page read and write
3A0000
heap
page read and write
61A01000
unkown
page execute read
100000
heap
page read and write
180029000
direct allocation
page read and write
22B000
heap
page read and write
2095000
heap
page read and write
10000
heap
page read and write
2CEF000
heap
page read and write
B8000
stack
page read and write
2D0E000
heap
page read and write
3B3000
heap
page read and write
2C6F000
stack
page read and write
2070000
remote allocation
page read and write
136000
heap
page read and write
2D1B000
heap
page read and write
61A0A000
unkown
page read and write
344E000
heap
page read and write
2AD0000
heap
page read and write
180000000
direct allocation
page read and write
2D60000
heap
page read and write
2D01000
heap
page read and write
48E000
stack
page read and write
520000
heap
page read and write
22FF000
stack
page read and write
2AF0000
heap
page read and write
2CDE000
heap
page read and write
2CF5000
heap
page read and write
4E0000
heap
page read and write
570000
heap
page read and write
510000
heap
page read and write
1E7000
heap
page read and write
2D0E000
heap
page read and write
2C28000
heap
page read and write
290000
direct allocation
page execute and read and write
344D000
heap
page read and write
2090000
heap
page read and write
345000
heap
page read and write
2CDC000
heap
page read and write
2D01000
heap
page read and write
39E000
heap
page read and write
2AA0000
heap
page read and write
2CE8000
heap
page read and write
2CF4000
heap
page read and write
2680000
heap
page read and write
61A00000
unkown
page readonly
2D01000
heap
page read and write
61A09000
unkown
page readonly
61A05000
unkown
page readonly
2CE4000
heap
page read and write
4AD000
heap
page read and write
450000
heap
page read and write
2F3000
heap
page read and write
443000
heap
page read and write
380000
heap
page read and write
61A0D000
unkown
page write copy
734000
heap
page read and write
443000
heap
page read and write
267F000
stack
page read and write
22FC000
stack
page read and write
2DE000
heap
page read and write
2E5F000
stack
page read and write
2C77000
heap
page read and write
2D0E000
stack
page read and write
3D6000
heap
page read and write
61A01000
unkown
page execute read
2F6000
heap
page read and write
2CFC000
heap
page read and write
180029000
direct allocation
page read and write
180000
trusted library allocation
page read and write
27EC000
stack
page read and write
1D4000
heap
page read and write
514000
heap
page read and write
BC000
stack
page read and write
18002A000
direct allocation
page readonly
2CDF000
heap
page read and write
514000
heap
page read and write
180000000
direct allocation
page read and write
498000
heap
page read and write
2CFC000
heap
page read and write
288B000
stack
page read and write
21B5000
heap
page read and write
3495000
heap
page read and write
10000
heap
page read and write
360000
heap
page read and write
450000
heap
page read and write
3474000
heap
page read and write
18002A000
direct allocation
page readonly
2CF4000
heap
page read and write
61A09000
unkown
page readonly
4E4000
heap
page read and write
190000
trusted library allocation
page read and write
2D0E000
heap
page read and write
2D10000
heap
page read and write
574000
heap
page read and write
3406000
heap
page read and write
34BB000
heap
page read and write
510000
heap
page read and write
2D01000
heap
page read and write
420000
heap
page read and write
21EB000
heap
page read and write
3F3000
heap
page read and write
3EC000
heap
page read and write
37B000
heap
page read and write
345000
heap
page read and write
180028000
direct allocation
page readonly
454000
heap
page read and write
460000
heap
page read and write
61A0A000
unkown
page read and write
3474000
heap
page read and write
1E0000
heap
page read and write
38E000
heap
page read and write
2CF4000
heap
page read and write
2C72000
heap
page read and write
213000
heap
page read and write
730000
heap
page read and write
61AAA000
unkown
page readonly
2070000
remote allocation
page read and write
344E000
heap
page read and write
2CDC000
heap
page read and write
53E000
stack
page read and write
1B6000
heap
page read and write
1D0000
heap
page read and write
2C20000
heap
page read and write
120000
direct allocation
page execute and read and write
344D000
heap
page read and write
20CB000
heap
page read and write
2C79000
heap
page read and write
21A000
heap
page read and write
2CE4000
heap
page read and write
21F5000
heap
page read and write
2CFC000
heap
page read and write
429000
heap
page read and write
10000
heap
page read and write
2CFC000
heap
page read and write
2E0000
heap
page read and write
2CFC000
heap
page read and write
2AC0000
heap
page read and write
2D0E000
heap
page read and write
350000
heap
page read and write
2CE4000
heap
page read and write
226000
heap
page read and write
2D0E000
heap
page read and write
351000
heap
page read and write
10000
heap
page read and write
2D01000
heap
page read and write
2D01000
heap
page read and write
27C000
stack
page read and write
20AF000
stack
page read and write
21B0000
heap
page read and write
20F5000
heap
page read and write
3A3000
heap
page read and write
240000
heap
page read and write
3EA000
heap
page read and write
2D0E000
heap
page read and write
61AAA000
unkown
page readonly
237F000
stack
page read and write
21DB000
stack
page read and write
A8F000
stack
page read and write
21D000
heap
page read and write
B0F000
stack
page read and write
486000
heap
page read and write
488000
heap
page read and write
61A00000
unkown
page readonly
2CFC000
heap
page read and write
2C88000
heap
page read and write
3BA000
heap
page read and write
33D1000
heap
page read and write
357000
heap
page read and write
2CF4000
heap
page read and write
2CCF000
heap
page read and write
2CF4000
heap
page read and write
2C0000
heap
page read and write
61A05000
unkown
page readonly
100000
heap
page read and write
34BB000
heap
page read and write
3427000
heap
page read and write
61A04000
unkown
page read and write
316000
heap
page read and write
212B000
heap
page read and write
2CDE000
heap
page read and write
2A7000
heap
page read and write
238000
stack
page read and write
556000
heap
page read and write
33D0000
heap
page read and write
7EFE0000
unkown
page readonly
367000
heap
page read and write
496000
heap
page read and write
3495000
heap
page read and write
104000
heap
page read and write
180028000
direct allocation
page readonly
2FA000
heap
page read and write
2D0E000
heap
page read and write
61A0D000
unkown
page write copy
1C7000
heap
page read and write
180000
heap
page read and write
4A8000
heap
page read and write
21F0000
heap
page read and write
500000
trusted library allocation
page read and write
276000
heap
page read and write
CD000
stack
page read and write
340000
heap
page read and write
2A0000
heap
page read and write
There are 211 hidden memdumps, click here to show them.