Malware Analysis Report

2025-01-22 14:17

Sample ID 240225-vm8zlagf25
Target a45496a17af60b0045a96f7099bba9a0
SHA256 9513de9c40cf83fec27c8307f85eb2f4e122eeaa1e0457cedbb9d06510329061
Tags
warzonerat zgrat infostealer rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

9513de9c40cf83fec27c8307f85eb2f4e122eeaa1e0457cedbb9d06510329061

Threat Level: Known bad

The file a45496a17af60b0045a96f7099bba9a0 was found to be: Known bad.

Malicious Activity Summary

warzonerat zgrat infostealer rat trojan

Detect ZGRat V1

ZGRat

WarzoneRat, AveMaria

Detects BazaLoader malware

Warzone RAT payload

Loads dropped DLL

Executes dropped EXE

Drops startup file

Suspicious use of SetThreadContext

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

Enumerates system info in registry

Suspicious use of SetWindowsHookEx

Checks processor information in registry

NTFS ADS

Modifies registry class

Suspicious use of WriteProcessMemory

Suspicious behavior: AddClipboardFormatListener

Modifies Internet Explorer settings

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-02-25 17:07

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-02-25 17:07

Reported

2024-02-25 17:10

Platform

win7-20240221-en

Max time kernel

122s

Max time network

123s

Command Line

"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\Account Statement.xll"

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\MenuExt C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14 C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597} C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Processes

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\Account Statement.xll"

Network

N/A

Files

memory/2844-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/2844-1-0x0000000071F6D000-0x0000000071F78000-memory.dmp

\Users\Admin\AppData\Local\Temp\Account Statement.xll

MD5 6833e89e130e02ac8ad1d0761c8009a9
SHA1 c078119ac85b3720004cd72dbd681f6aa2ba57f2
SHA256 fac07feef803ffda906e12d26b08b468039b321daf7e706a83a9ef1b4b87f44a
SHA512 d99a0a4f22c9bfac4de9a5f705b5d9db5a54dec958ecda563ba9bead9b2db21522476ae964c6b27d60946ee4053459de582dbee73a1687a061dc4f4d39bd40a9

memory/2844-3-0x0000000071F6D000-0x0000000071F78000-memory.dmp

memory/2844-4-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/2844-5-0x0000000071F6D000-0x0000000071F78000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-02-25 17:07

Reported

2024-02-25 17:10

Platform

win10v2004-20240221-en

Max time kernel

146s

Max time network

154s

Command Line

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Account Statement.xll"

Signatures

Detect ZGRat V1

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects BazaLoader malware

trojan
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

WarzoneRat, AveMaria

rat infostealer warzonerat

ZGRat

rat zgrat

Warzone RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat C:\Users\Admin\AppData\Local\Temp\service.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat:start C:\Users\Admin\AppData\Local\Temp\service.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3944 set thread context of 1732 N/A C:\Users\Admin\AppData\Roaming\service.exe C:\Users\Admin\AppData\Local\Temp\service.exe
PID 4224 set thread context of 5012 N/A C:\ProgramData\win32.exe C:\Users\Admin\AppData\Local\Temp\win32.exe

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

NTFS ADS

Description Indicator Process Target
File created C:\ProgramData:ApplicationData C:\Users\Admin\AppData\Local\Temp\service.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\service.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\win32.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4092 wrote to memory of 3944 N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE C:\Users\Admin\AppData\Roaming\service.exe
PID 4092 wrote to memory of 3944 N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE C:\Users\Admin\AppData\Roaming\service.exe
PID 4092 wrote to memory of 3944 N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE C:\Users\Admin\AppData\Roaming\service.exe
PID 3944 wrote to memory of 4392 N/A C:\Users\Admin\AppData\Roaming\service.exe C:\Users\Admin\AppData\Local\Temp\service.exe
PID 3944 wrote to memory of 4392 N/A C:\Users\Admin\AppData\Roaming\service.exe C:\Users\Admin\AppData\Local\Temp\service.exe
PID 3944 wrote to memory of 4392 N/A C:\Users\Admin\AppData\Roaming\service.exe C:\Users\Admin\AppData\Local\Temp\service.exe
PID 3944 wrote to memory of 840 N/A C:\Users\Admin\AppData\Roaming\service.exe C:\Users\Admin\AppData\Local\Temp\service.exe
PID 3944 wrote to memory of 840 N/A C:\Users\Admin\AppData\Roaming\service.exe C:\Users\Admin\AppData\Local\Temp\service.exe
PID 3944 wrote to memory of 840 N/A C:\Users\Admin\AppData\Roaming\service.exe C:\Users\Admin\AppData\Local\Temp\service.exe
PID 3944 wrote to memory of 1388 N/A C:\Users\Admin\AppData\Roaming\service.exe C:\Users\Admin\AppData\Local\Temp\service.exe
PID 3944 wrote to memory of 1388 N/A C:\Users\Admin\AppData\Roaming\service.exe C:\Users\Admin\AppData\Local\Temp\service.exe
PID 3944 wrote to memory of 1388 N/A C:\Users\Admin\AppData\Roaming\service.exe C:\Users\Admin\AppData\Local\Temp\service.exe
PID 3944 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Roaming\service.exe C:\Users\Admin\AppData\Local\Temp\service.exe
PID 3944 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Roaming\service.exe C:\Users\Admin\AppData\Local\Temp\service.exe
PID 3944 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Roaming\service.exe C:\Users\Admin\AppData\Local\Temp\service.exe
PID 3944 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Roaming\service.exe C:\Users\Admin\AppData\Local\Temp\service.exe
PID 3944 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Roaming\service.exe C:\Users\Admin\AppData\Local\Temp\service.exe
PID 3944 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Roaming\service.exe C:\Users\Admin\AppData\Local\Temp\service.exe
PID 3944 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Roaming\service.exe C:\Users\Admin\AppData\Local\Temp\service.exe
PID 3944 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Roaming\service.exe C:\Users\Admin\AppData\Local\Temp\service.exe
PID 3944 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Roaming\service.exe C:\Users\Admin\AppData\Local\Temp\service.exe
PID 3944 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Roaming\service.exe C:\Users\Admin\AppData\Local\Temp\service.exe
PID 1732 wrote to memory of 3512 N/A C:\Users\Admin\AppData\Local\Temp\service.exe C:\Windows\SysWOW64\cmd.exe
PID 1732 wrote to memory of 3512 N/A C:\Users\Admin\AppData\Local\Temp\service.exe C:\Windows\SysWOW64\cmd.exe
PID 1732 wrote to memory of 3512 N/A C:\Users\Admin\AppData\Local\Temp\service.exe C:\Windows\SysWOW64\cmd.exe
PID 1732 wrote to memory of 4224 N/A C:\Users\Admin\AppData\Local\Temp\service.exe C:\ProgramData\win32.exe
PID 1732 wrote to memory of 4224 N/A C:\Users\Admin\AppData\Local\Temp\service.exe C:\ProgramData\win32.exe
PID 1732 wrote to memory of 4224 N/A C:\Users\Admin\AppData\Local\Temp\service.exe C:\ProgramData\win32.exe
PID 3512 wrote to memory of 2244 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3512 wrote to memory of 2244 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3512 wrote to memory of 2244 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4224 wrote to memory of 456 N/A C:\ProgramData\win32.exe C:\Users\Admin\AppData\Local\Temp\win32.exe
PID 4224 wrote to memory of 456 N/A C:\ProgramData\win32.exe C:\Users\Admin\AppData\Local\Temp\win32.exe
PID 4224 wrote to memory of 456 N/A C:\ProgramData\win32.exe C:\Users\Admin\AppData\Local\Temp\win32.exe
PID 4224 wrote to memory of 3340 N/A C:\ProgramData\win32.exe C:\Users\Admin\AppData\Local\Temp\win32.exe
PID 4224 wrote to memory of 3340 N/A C:\ProgramData\win32.exe C:\Users\Admin\AppData\Local\Temp\win32.exe
PID 4224 wrote to memory of 3340 N/A C:\ProgramData\win32.exe C:\Users\Admin\AppData\Local\Temp\win32.exe
PID 4224 wrote to memory of 2132 N/A C:\ProgramData\win32.exe C:\Users\Admin\AppData\Local\Temp\win32.exe
PID 4224 wrote to memory of 2132 N/A C:\ProgramData\win32.exe C:\Users\Admin\AppData\Local\Temp\win32.exe
PID 4224 wrote to memory of 2132 N/A C:\ProgramData\win32.exe C:\Users\Admin\AppData\Local\Temp\win32.exe
PID 4224 wrote to memory of 5012 N/A C:\ProgramData\win32.exe C:\Users\Admin\AppData\Local\Temp\win32.exe
PID 4224 wrote to memory of 5012 N/A C:\ProgramData\win32.exe C:\Users\Admin\AppData\Local\Temp\win32.exe
PID 4224 wrote to memory of 5012 N/A C:\ProgramData\win32.exe C:\Users\Admin\AppData\Local\Temp\win32.exe
PID 4224 wrote to memory of 5012 N/A C:\ProgramData\win32.exe C:\Users\Admin\AppData\Local\Temp\win32.exe
PID 4224 wrote to memory of 5012 N/A C:\ProgramData\win32.exe C:\Users\Admin\AppData\Local\Temp\win32.exe
PID 4224 wrote to memory of 5012 N/A C:\ProgramData\win32.exe C:\Users\Admin\AppData\Local\Temp\win32.exe
PID 4224 wrote to memory of 5012 N/A C:\ProgramData\win32.exe C:\Users\Admin\AppData\Local\Temp\win32.exe
PID 4224 wrote to memory of 5012 N/A C:\ProgramData\win32.exe C:\Users\Admin\AppData\Local\Temp\win32.exe
PID 4224 wrote to memory of 5012 N/A C:\ProgramData\win32.exe C:\Users\Admin\AppData\Local\Temp\win32.exe
PID 4224 wrote to memory of 5012 N/A C:\ProgramData\win32.exe C:\Users\Admin\AppData\Local\Temp\win32.exe
PID 5012 wrote to memory of 1264 N/A C:\Users\Admin\AppData\Local\Temp\win32.exe C:\Windows\SysWOW64\cmd.exe
PID 5012 wrote to memory of 1264 N/A C:\Users\Admin\AppData\Local\Temp\win32.exe C:\Windows\SysWOW64\cmd.exe
PID 5012 wrote to memory of 1264 N/A C:\Users\Admin\AppData\Local\Temp\win32.exe C:\Windows\SysWOW64\cmd.exe
PID 5012 wrote to memory of 1264 N/A C:\Users\Admin\AppData\Local\Temp\win32.exe C:\Windows\SysWOW64\cmd.exe
PID 5012 wrote to memory of 1264 N/A C:\Users\Admin\AppData\Local\Temp\win32.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Account Statement.xll"

C:\Users\Admin\AppData\Roaming\service.exe

"C:\Users\Admin\AppData\Roaming\service.exe"

C:\Users\Admin\AppData\Local\Temp\service.exe

C:\Users\Admin\AppData\Local\Temp\service.exe

C:\Users\Admin\AppData\Local\Temp\service.exe

C:\Users\Admin\AppData\Local\Temp\service.exe

C:\Users\Admin\AppData\Local\Temp\service.exe

C:\Users\Admin\AppData\Local\Temp\service.exe

C:\Users\Admin\AppData\Local\Temp\service.exe

C:\Users\Admin\AppData\Local\Temp\service.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\win32.exe"

C:\ProgramData\win32.exe

"C:\ProgramData\win32.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\win32.exe"

C:\Users\Admin\AppData\Local\Temp\win32.exe

C:\Users\Admin\AppData\Local\Temp\win32.exe

C:\Users\Admin\AppData\Local\Temp\win32.exe

C:\Users\Admin\AppData\Local\Temp\win32.exe

C:\Users\Admin\AppData\Local\Temp\win32.exe

C:\Users\Admin\AppData\Local\Temp\win32.exe

C:\Users\Admin\AppData\Local\Temp\win32.exe

C:\Users\Admin\AppData\Local\Temp\win32.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 18.89.109.52.in-addr.arpa udp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 176.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 136.71.105.51.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 tobi12345.hopto.org udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tobi12345.hopto.org udp
US 8.8.8.8:53 tobi12345.hopto.org udp
US 8.8.8.8:53 tobi12345.hopto.org udp
US 8.8.8.8:53 tobi12345.hopto.org udp
US 8.8.8.8:53 tobi12345.hopto.org udp
US 8.8.8.8:53 189.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 tobi12345.hopto.org udp
US 8.8.8.8:53 tobi12345.hopto.org udp
US 8.8.8.8:53 tobi12345.hopto.org udp
US 8.8.8.8:53 tobi12345.hopto.org udp
US 8.8.8.8:53 tobi12345.hopto.org udp
US 8.8.8.8:53 tobi12345.hopto.org udp
US 8.8.8.8:53 tobi12345.hopto.org udp
US 8.8.8.8:53 tobi12345.hopto.org udp
US 8.8.8.8:53 tobi12345.hopto.org udp
US 8.8.8.8:53 tobi12345.hopto.org udp
US 8.8.8.8:53 tobi12345.hopto.org udp
US 8.8.8.8:53 131.72.42.20.in-addr.arpa udp

Files

memory/4092-0-0x00007FFBCE5D0000-0x00007FFBCE5E0000-memory.dmp

memory/4092-1-0x00007FFBCE5D0000-0x00007FFBCE5E0000-memory.dmp

memory/4092-2-0x00007FFC0E550000-0x00007FFC0E745000-memory.dmp

memory/4092-4-0x00007FFC0E550000-0x00007FFC0E745000-memory.dmp

memory/4092-3-0x00007FFBCE5D0000-0x00007FFBCE5E0000-memory.dmp

memory/4092-5-0x00007FFC0E550000-0x00007FFC0E745000-memory.dmp

memory/4092-6-0x00007FFC0E550000-0x00007FFC0E745000-memory.dmp

memory/4092-7-0x00007FFBCE5D0000-0x00007FFBCE5E0000-memory.dmp

memory/4092-8-0x00007FFC0E550000-0x00007FFC0E745000-memory.dmp

memory/4092-10-0x00007FFBCE5D0000-0x00007FFBCE5E0000-memory.dmp

memory/4092-9-0x00007FFC0E550000-0x00007FFC0E745000-memory.dmp

memory/4092-11-0x00007FFC0E550000-0x00007FFC0E745000-memory.dmp

memory/4092-12-0x00007FFC0E550000-0x00007FFC0E745000-memory.dmp

memory/4092-13-0x00007FFBCC050000-0x00007FFBCC060000-memory.dmp

memory/4092-14-0x00007FFC0E550000-0x00007FFC0E745000-memory.dmp

memory/4092-15-0x00007FFC0E550000-0x00007FFC0E745000-memory.dmp

memory/4092-17-0x00007FFBCC050000-0x00007FFBCC060000-memory.dmp

memory/4092-18-0x00007FFC0E550000-0x00007FFC0E745000-memory.dmp

memory/4092-16-0x00007FFC0E550000-0x00007FFC0E745000-memory.dmp

memory/4092-23-0x0000019326C60000-0x0000019326D59000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Account Statement.xll

MD5 b50fea4606274bedc8d82dfdb050894e
SHA1 3fbc9e317c1d373fa02e0c6ec4b615f334e3104c
SHA256 df51d17576e6b5ff7488221079a6d0beb42cebf347c7ea04f4b07f2188863a16
SHA512 fdfbd571b5c018b0b50ae025e59069f2e5b708af53c4df5e888328c0d7d0d4d70c8e8a3f8b5be708a49ec3bfa6d6a37dd2c0e932980c849e95ba17a233c3d95a

memory/4092-29-0x0000019328190000-0x00000193281AC000-memory.dmp

memory/4092-31-0x0000019328300000-0x000001932833C000-memory.dmp

memory/4092-30-0x00007FFBE5680000-0x00007FFBE6141000-memory.dmp

memory/4092-32-0x0000019328570000-0x0000019328580000-memory.dmp

memory/4092-33-0x0000019328570000-0x0000019328580000-memory.dmp

memory/4092-34-0x0000019328570000-0x0000019328580000-memory.dmp

memory/4092-35-0x0000019328570000-0x0000019328580000-memory.dmp

memory/4092-36-0x0000019328570000-0x0000019328580000-memory.dmp

memory/4092-37-0x0000019323A30000-0x0000019323A8C000-memory.dmp

memory/4092-38-0x0000019323A90000-0x0000019323AA0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\sample.xlsx

MD5 36cadc2fa9f7938f74061fda9b126a9f
SHA1 5252934ac46fb3bc8fdb361880ade043070501bd
SHA256 afc8ea53b3eeb62a44ce6d2b4593931d009ec00769410e76478cc88eab59d1f4
SHA512 b7668575cea53280a3d553b18e1ac7670eeafab9f2d48db5d86496722e2b1d5d48a3ac3b1e56a8d7198abd771f2d95fef4449792c214dffc2097e62273e7db1f

C:\Users\Admin\AppData\Roaming\service.exe

MD5 909737a0a11765901cdce436737ac172
SHA1 00d77473c837e0ed2887d6285a6c3c9e47ec83c8
SHA256 39cd390039e7ad850abd64cfc0b387c77470153c09d35108cf96a893185804a2
SHA512 e0989e9178201f126cc600b2d64c3609ff58f7ee3ab55f177fd7301f32cf13322afe7fdbe7334c52892ffc4f5b193fb38d841371c196ac44341bd54211dab2a2

memory/3944-74-0x0000000074550000-0x0000000074D00000-memory.dmp

memory/3944-73-0x0000000000640000-0x0000000000696000-memory.dmp

memory/3944-75-0x0000000005570000-0x0000000005B14000-memory.dmp

memory/3944-76-0x0000000005100000-0x0000000005192000-memory.dmp

memory/3944-77-0x00000000050F0000-0x0000000005100000-memory.dmp

memory/3944-78-0x00000000050B0000-0x00000000050BA000-memory.dmp

memory/4092-81-0x00007FFC0E550000-0x00007FFC0E745000-memory.dmp

memory/4092-82-0x00007FFC0E550000-0x00007FFC0E745000-memory.dmp

memory/4092-83-0x00007FFC0E550000-0x00007FFC0E745000-memory.dmp

memory/4092-84-0x00007FFBE5680000-0x00007FFBE6141000-memory.dmp

memory/4092-85-0x0000019328570000-0x0000019328580000-memory.dmp

memory/4092-86-0x0000019328570000-0x0000019328580000-memory.dmp

memory/4092-87-0x0000019328570000-0x0000019328580000-memory.dmp

memory/4092-88-0x0000019328570000-0x0000019328580000-memory.dmp

memory/4092-89-0x0000019328570000-0x0000019328580000-memory.dmp

memory/3944-90-0x0000000006370000-0x00000000063C0000-memory.dmp

memory/3944-91-0x0000000006500000-0x0000000006566000-memory.dmp

memory/3944-92-0x0000000006500000-0x0000000006561000-memory.dmp

memory/3944-93-0x0000000006500000-0x0000000006561000-memory.dmp

memory/3944-95-0x0000000006500000-0x0000000006561000-memory.dmp

memory/3944-97-0x0000000006500000-0x0000000006561000-memory.dmp

memory/3944-99-0x0000000006500000-0x0000000006561000-memory.dmp

memory/3944-101-0x0000000006500000-0x0000000006561000-memory.dmp

memory/3944-103-0x0000000006500000-0x0000000006561000-memory.dmp

memory/3944-105-0x0000000006500000-0x0000000006561000-memory.dmp

memory/3944-107-0x0000000006500000-0x0000000006561000-memory.dmp

memory/3944-109-0x0000000006500000-0x0000000006561000-memory.dmp

memory/3944-111-0x0000000006500000-0x0000000006561000-memory.dmp

memory/3944-113-0x0000000006500000-0x0000000006561000-memory.dmp

memory/3944-115-0x0000000006500000-0x0000000006561000-memory.dmp

memory/3944-117-0x0000000006500000-0x0000000006561000-memory.dmp

memory/3944-119-0x0000000006500000-0x0000000006561000-memory.dmp

memory/3944-121-0x0000000006500000-0x0000000006561000-memory.dmp

memory/3944-123-0x0000000006500000-0x0000000006561000-memory.dmp

memory/3944-125-0x0000000006500000-0x0000000006561000-memory.dmp

memory/3944-127-0x0000000006500000-0x0000000006561000-memory.dmp

memory/3944-129-0x0000000006500000-0x0000000006561000-memory.dmp

memory/3944-131-0x0000000006500000-0x0000000006561000-memory.dmp

memory/3944-133-0x0000000006500000-0x0000000006561000-memory.dmp

memory/3944-135-0x0000000006500000-0x0000000006561000-memory.dmp

memory/3944-137-0x0000000006500000-0x0000000006561000-memory.dmp

memory/3944-139-0x0000000006500000-0x0000000006561000-memory.dmp

memory/3944-141-0x0000000006500000-0x0000000006561000-memory.dmp

memory/3944-143-0x0000000006500000-0x0000000006561000-memory.dmp

memory/3944-145-0x0000000006500000-0x0000000006561000-memory.dmp

memory/3944-514-0x0000000074550000-0x0000000074D00000-memory.dmp

memory/3944-1498-0x00000000050F0000-0x0000000005100000-memory.dmp

memory/3944-2033-0x0000000074550000-0x0000000074D00000-memory.dmp

memory/1732-2034-0x0000000000400000-0x000000000055E000-memory.dmp

C:\ProgramData\

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/1732-2044-0x0000000000400000-0x000000000055E000-memory.dmp

memory/4224-2045-0x0000000073E20000-0x00000000745D0000-memory.dmp

memory/4224-2046-0x0000000002D70000-0x0000000002D80000-memory.dmp

memory/4224-2273-0x0000000073E20000-0x00000000745D0000-memory.dmp

memory/4224-3238-0x0000000002D70000-0x0000000002D80000-memory.dmp

memory/5012-3989-0x0000000000400000-0x000000000055E000-memory.dmp

memory/4224-3990-0x0000000073E20000-0x00000000745D0000-memory.dmp

memory/5012-3996-0x0000000000400000-0x000000000055E000-memory.dmp

memory/4092-4014-0x00007FFC0E550000-0x00007FFC0E745000-memory.dmp

memory/4092-4015-0x00007FFBE5680000-0x00007FFBE6141000-memory.dmp