IOC Report
PO 2_5_24.xlam.xlsx

loading gif

Files

File Path
Type
Category
Malicious
PO 2_5_24.xlam.xlsx
Microsoft Excel 2007+
initial sample
 malicious
C:\Users\user\AppData\Roaming\CKK.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\Clinton
data
dropped
C:\Users\user\AppData\Local\Temp\aut9A3D.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\aut9AAC.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\nondefinition
ASCII text, with very long lines (28720), with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\~$imgs.xlsx
data
dropped
C:\Users\user\Desktop\~$PO 2_5_24.xlam.xls
data
dropped
C:\Users\user\Desktop\~$PO 2_5_24.xlam.xlsx
data
dropped

Processes

Path
Cmdline
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
 malicious
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
 malicious
C:\Users\user\AppData\Roaming\CKK.exe
"C:\Users\user\AppData\Roaming\CKK.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\user\AppData\Roaming\CKK.exe"
 malicious

URLs

Name
IP
Malicious
http://23.94.54.101/ISW.exe
23.94.54.101
 malicious
https://api.ipify.org/
104.26.12.205
https://api.ipify.org
unknown
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
unknown
https://account.dyn.com/
unknown
http://crl.entrust.net/server1.crl0
unknown
http://ocsp.entrust.net03
unknown
https://api.ipif8z
unknown
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
unknown
http://www.diginotar.nl/cps/pkioverheid0
unknown
https://api.ipify.org/T
unknown
https://api.ipify.org/t
unknown
http://ocsp.entrust.net0D
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
https://secure.comodo.com/CPS0
unknown
http://crl.entrust.net/2048ca.crl0
unknown
http://api.ipify.org
unknown
There are 7 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
api.ipify.org
104.26.12.205

IPs

IP
Domain
Country
Malicious
23.94.54.101
unknown
United States
malicious
104.26.12.205
api.ipify.org
United States

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
;|'
HKEY_CURRENT_USER\Software\Microsoft\Shared Tools\Outlook\Journaling\Microsoft Excel
Enabled
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel
MTTT
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\ReviewCycle
ReviewToken
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
>a'
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Security\Trusted Documents
LastPurgeTime
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
1033
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
EXCELFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
ProductFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
VBAFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109E60090400100000000F01FEC\Usage
EquationEditorFilesIntl_1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109E60090400100000000F01FEC\Usage
EquationEditorFilesIntl_1033
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C
Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C
Blob
There are 22 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
450000
trusted library section
page read and write
 malicious
4C0000
trusted library section
page read and write
 malicious
400000
system
page execute and read and write
 malicious
140000
direct allocation
page read and write
 malicious
3441000
trusted library allocation
page read and write
 malicious
A2F000
heap
page read and write
 malicious
6E20000
heap
page read and write
F70000
direct allocation
page read and write
B0000
trusted library allocation
page read and write
124B000
heap
page read and write
10000
heap
page read and write
2E61000
direct allocation
page read and write
5AAF000
stack
page read and write
1DFF000
stack
page read and write
517000
heap
page read and write
571B000
heap
page read and write
4A6D000
stack
page read and write
1C2000
trusted library allocation
page read and write
18B000
stack
page read and write
2440000
heap
page read and write
5F01000
heap
page read and write
E4E000
stack
page read and write
2ED0000
direct allocation
page read and write
280000
trusted library allocation
page read and write
701F000
stack
page read and write
2E70000
direct allocation
page read and write
2E61000
direct allocation
page read and write
F14000
unkown
page readonly
1E3E000
stack
page read and write
1B6000
trusted library allocation
page execute and read and write
2ED0000
direct allocation
page read and write
24EB000
trusted library allocation
page read and write
104A000
direct allocation
page read and write
124B000
heap
page read and write
1AD000
trusted library allocation
page execute and read and write
2E50000
direct allocation
page read and write
564000
heap
page read and write
2E67000
direct allocation
page read and write
1268000
heap
page read and write
2E67000
direct allocation
page read and write
2E67000
direct allocation
page read and write
124B000
heap
page read and write
10000
heap
page read and write
6A40000
heap
page read and write
5EDE000
stack
page read and write
637000
heap
page read and write
1C7000
trusted library allocation
page execute and read and write
2D70000
direct allocation
page read and write
D30000
trusted library allocation
page execute and read and write
130000
heap
page read and write
258C000
trusted library allocation
page read and write
3E0000
remote allocation
page read and write
6C4000
heap
page read and write
3E0000
remote allocation
page read and write
557000
heap
page read and write
6E1F000
stack
page read and write
2ED0000
direct allocation
page read and write
24F9000
trusted library allocation
page read and write
260000
heap
page read and write
CCE000
stack
page read and write
5CAE000
stack
page read and write
127A000
heap
page read and write
1187000
heap
page read and write
136000
heap
page read and write
F70000
direct allocation
page read and write
124B000
heap
page read and write
2D60000
direct allocation
page read and write
7EF40000
trusted library allocation
page execute and read and write
2B8F000
stack
page read and write
123B000
heap
page read and write
1E60000
heap
page read and write
248F000
trusted library allocation
page read and write
2556000
trusted library allocation
page read and write
24EE000
trusted library allocation
page read and write
2D70000
direct allocation
page read and write
711F000
stack
page read and write
4970000
heap
page execute and read and write
2441000
trusted library allocation
page read and write
E40000
unkown
page readonly
2E67000
direct allocation
page read and write
2C0E000
stack
page read and write
1A3000
trusted library allocation
page read and write
B18000
trusted library allocation
page read and write
35A5000
heap
page read and write
F70000
direct allocation
page read and write
258E000
trusted library allocation
page read and write
232E000
stack
page read and write
6A0000
heap
page read and write
127B000
heap
page read and write
510000
heap
page read and write
E70000
heap
page execute and read and write
2E70000
direct allocation
page read and write
104D000
direct allocation
page read and write
2E61000
direct allocation
page read and write
1187000
heap
page read and write
1A0000
trusted library allocation
page read and write
F0C000
unkown
page write copy
1259000
heap
page read and write
127B000
heap
page read and write
111C000
heap
page read and write
190000
heap
page read and write
1CFF000
stack
page read and write
294F000
stack
page read and write
ED000
trusted library allocation
page execute and read and write
654000
heap
page read and write
80F000
stack
page read and write
BD9000
trusted library allocation
page read and write
557E000
stack
page read and write
242E000
stack
page read and write
2572000
trusted library allocation
page read and write
2E64000
direct allocation
page read and write
2E67000
direct allocation
page read and write
F02000
unkown
page readonly
F14000
unkown
page readonly
1194000
heap
page read and write
EDC000
unkown
page readonly
2D70000
direct allocation
page read and write
CF0000
heap
page execute and read and write
6CE0000
heap
page read and write
254E000
trusted library allocation
page read and write
7CF000
stack
page read and write
2532000
trusted library allocation
page read and write
5EF0000
heap
page read and write
104D000
direct allocation
page read and write
2E70000
direct allocation
page read and write
2D70000
direct allocation
page read and write
1186000
heap
page read and write
104A000
direct allocation
page read and write
1E70000
direct allocation
page read and write
124C000
heap
page read and write
2C24000
heap
page read and write
194000
heap
page read and write
630000
heap
page read and write
E3000
trusted library allocation
page execute and read and write
126B000
heap
page read and write
112A000
heap
page read and write
1259000
heap
page read and write
1194000
heap
page read and write
2E64000
direct allocation
page read and write
243F000
stack
page read and write
65F000
heap
page read and write
4FCF000
stack
page read and write
6A2E000
stack
page read and write
F70000
direct allocation
page read and write
1194000
heap
page read and write
69EF000
stack
page read and write
2E64000
direct allocation
page read and write
2E64000
direct allocation
page read and write
D60000
trusted library allocation
page execute and read and write
1F0000
heap
page read and write
4B6F000
stack
page read and write
104A000
direct allocation
page read and write
2D60000
direct allocation
page read and write
EDC000
unkown
page readonly
2C20000
heap
page read and write
104A000
direct allocation
page read and write
690000
heap
page read and write
E41000
unkown
page execute read
4A2D000
stack
page read and write
5940000
heap
page read and write
110000
direct allocation
page execute and read and write
2E70000
direct allocation
page read and write
2D60000
direct allocation
page read and write
112D000
heap
page read and write
1276000
heap
page read and write
240000
heap
page read and write
104A000
direct allocation
page read and write
236F000
stack
page read and write
2E67000
direct allocation
page read and write
2D60000
direct allocation
page read and write
7FF000
stack
page read and write
2E70000
direct allocation
page read and write
360000
heap
page read and write
2E50000
direct allocation
page read and write
52B0000
heap
page read and write
2E50000
direct allocation
page read and write
F10000
unkown
page write copy
C0000
heap
page read and write
810000
heap
page read and write
104D000
direct allocation
page read and write
E41000
unkown
page execute read
D7000
heap
page read and write
2E64000
direct allocation
page read and write
2479000
trusted library allocation
page read and write
E0000
trusted library allocation
page read and write
2538000
trusted library allocation
page read and write
1194000
heap
page read and write
1268000
heap
page read and write
2BCF000
stack
page read and write
BE0000
heap
page read and write
5DBE000
stack
page read and write
112D000
heap
page read and write
583E000
stack
page read and write
24F3000
trusted library allocation
page read and write
3590000
heap
page read and write
696000
heap
page read and write
3C0000
heap
page read and write
1104000
heap
page read and write
6B7F000
stack
page read and write
C6D000
stack
page read and write
5BAF000
stack
page read and write
2ED0000
direct allocation
page read and write
E4000
trusted library allocation
page read and write
1259000
heap
page read and write
593E000
stack
page read and write
24D4000
trusted library allocation
page read and write
2482000
trusted library allocation
page read and write
CD0000
trusted library allocation
page read and write
3E2000
heap
page read and write
7DF000
stack
page read and write
2ED0000
direct allocation
page read and write
2E61000
direct allocation
page read and write
270000
trusted library allocation
page execute and read and write
5270000
heap
page read and write
7EC000
stack
page read and write
112D000
heap
page read and write
2E50000
direct allocation
page read and write
2444000
heap
page read and write
F02000
unkown
page readonly
3C4000
heap
page read and write
23AD000
stack
page read and write
104A000
direct allocation
page read and write
562000
heap
page read and write
1BA000
trusted library allocation
page execute and read and write
1194000
heap
page read and write
1B2000
trusted library allocation
page read and write
1C5000
trusted library allocation
page execute and read and write
3A0000
trusted library allocation
page read and write
F70000
direct allocation
page read and write
3B0000
trusted library allocation
page read and write
F0C000
unkown
page read and write
2D70000
direct allocation
page read and write
24FC000
trusted library allocation
page read and write
10000
heap
page read and write
104D000
direct allocation
page read and write
2576000
trusted library allocation
page read and write
1CB000
trusted library allocation
page execute and read and write
48AF000
stack
page read and write
2D60000
direct allocation
page read and write
2E50000
direct allocation
page read and write
90000
trusted library section
page read and write
454E000
stack
page read and write
23EE000
stack
page read and write
5B1000
heap
page read and write
E40000
unkown
page readonly
2ED0000
direct allocation
page read and write
89000
stack
page read and write
BD0000
trusted library allocation
page read and write
1194000
heap
page read and write
2E70000
direct allocation
page read and write
2462000
heap
page read and write
1B2000
heap
page read and write
52CD000
heap
page read and write
F70000
direct allocation
page read and write
56D0000
heap
page read and write
2565000
trusted library allocation
page read and write
2C2B000
heap
page read and write
445000
system
page execute and read and write
1259000
heap
page read and write
12A000
stack
page read and write
2E61000
direct allocation
page read and write
56F4000
heap
page read and write
980000
heap
page read and write
104D000
direct allocation
page read and write
1195000
heap
page read and write
579000
heap
page read and write
1194000
heap
page read and write
50EC000
stack
page read and write
2D60000
direct allocation
page read and write
3503000
trusted library allocation
page read and write
124C000
heap
page read and write
360000
heap
page read and write
1B0000
trusted library allocation
page read and write
2E61000
direct allocation
page read and write
2E64000
direct allocation
page read and write
A0000
trusted library section
page read and write
6BF0000
heap
page read and write
104D000
direct allocation
page read and write
1194000
heap
page read and write
1194000
heap
page read and write
10E7000
heap
page read and write
4B0000
heap
page read and write
124C000
heap
page read and write
2D70000
direct allocation
page read and write
60D0000
heap
page read and write
388000
stack
page read and write
2C28000
heap
page read and write
26A000
stack
page read and write
2D20000
heap
page read and write
267000
heap
page read and write
2493000
trusted library allocation
page read and write
DEE000
stack
page read and write
568F000
stack
page read and write
2E50000
direct allocation
page read and write
535000
heap
page read and write
D70000
heap
page read and write
56E1000
heap
page read and write
D0000
heap
page read and write
10E0000
heap
page read and write
284F000
stack
page read and write
6A5000
heap
page read and write
There are 291 hidden memdumps, click here to show them.