Malware Analysis Report

2024-11-30 06:43

Sample ID 240604-bs7h6shb42
Target e3f883dc3b401f7232adb797186f47b2d037951afb8cae4f80db0f9cb532b59e
SHA256 e3f883dc3b401f7232adb797186f47b2d037951afb8cae4f80db0f9cb532b59e
Tags
agenttesla keylogger spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e3f883dc3b401f7232adb797186f47b2d037951afb8cae4f80db0f9cb532b59e

Threat Level: Known bad

The file e3f883dc3b401f7232adb797186f47b2d037951afb8cae4f80db0f9cb532b59e was found to be: Known bad.

Malicious Activity Summary

agenttesla keylogger spyware stealer trojan

AgentTesla

Blocklisted process makes network request

Downloads MZ/PE file

Reads user/profile data of web browsers

Executes dropped EXE

Reads WinSCP keys stored on the system

Reads user/profile data of local email clients

Reads data files stored by FTP clients

Loads dropped DLL

Abuses OpenXML format to download file from external location

Suspicious use of SetThreadContext

Office loads VBA resources, possible macro or embedded object present

Enumerates system info in registry

Uses Volume Shadow Copy WMI provider

Uses Volume Shadow Copy service COM API

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Modifies Internet Explorer settings

Launches Equation Editor

Modifies registry class

Uses Task Scheduler COM API

Checks processor information in registry

Suspicious use of WriteProcessMemory

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-04 01:25

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-04 01:25

Reported

2024-06-04 01:28

Platform

win7-20240508-en

Max time kernel

144s

Max time network

119s

Command Line

"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\e3f883dc3b401f7232adb797186f47b2d037951afb8cae4f80db0f9cb532b59e.xls

Signatures

AgentTesla

keylogger trojan stealer spyware agenttesla

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE N/A

Downloads MZ/PE file

Abuses OpenXML format to download file from external location

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\igcc.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\igcc.exe N/A

Reads WinSCP keys stored on the system

spyware stealer

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 268 set thread context of 676 N/A C:\Users\Admin\AppData\Roaming\igcc.exe C:\Users\Admin\AppData\Roaming\igcc.exe

Office loads VBA resources, possible macro or embedded object present

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Launches Equation Editor

exploit
Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\MenuExt C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Modifies registry class

Description Indicator Process Target
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\igcc.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\igcc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\igcc.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2924 wrote to memory of 268 N/A C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE C:\Users\Admin\AppData\Roaming\igcc.exe
PID 2924 wrote to memory of 268 N/A C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE C:\Users\Admin\AppData\Roaming\igcc.exe
PID 2924 wrote to memory of 268 N/A C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE C:\Users\Admin\AppData\Roaming\igcc.exe
PID 2924 wrote to memory of 268 N/A C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE C:\Users\Admin\AppData\Roaming\igcc.exe
PID 2628 wrote to memory of 2464 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2628 wrote to memory of 2464 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2628 wrote to memory of 2464 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2628 wrote to memory of 2464 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 268 wrote to memory of 676 N/A C:\Users\Admin\AppData\Roaming\igcc.exe C:\Users\Admin\AppData\Roaming\igcc.exe
PID 268 wrote to memory of 676 N/A C:\Users\Admin\AppData\Roaming\igcc.exe C:\Users\Admin\AppData\Roaming\igcc.exe
PID 268 wrote to memory of 676 N/A C:\Users\Admin\AppData\Roaming\igcc.exe C:\Users\Admin\AppData\Roaming\igcc.exe
PID 268 wrote to memory of 676 N/A C:\Users\Admin\AppData\Roaming\igcc.exe C:\Users\Admin\AppData\Roaming\igcc.exe
PID 268 wrote to memory of 676 N/A C:\Users\Admin\AppData\Roaming\igcc.exe C:\Users\Admin\AppData\Roaming\igcc.exe
PID 268 wrote to memory of 676 N/A C:\Users\Admin\AppData\Roaming\igcc.exe C:\Users\Admin\AppData\Roaming\igcc.exe
PID 268 wrote to memory of 676 N/A C:\Users\Admin\AppData\Roaming\igcc.exe C:\Users\Admin\AppData\Roaming\igcc.exe
PID 268 wrote to memory of 676 N/A C:\Users\Admin\AppData\Roaming\igcc.exe C:\Users\Admin\AppData\Roaming\igcc.exe
PID 268 wrote to memory of 676 N/A C:\Users\Admin\AppData\Roaming\igcc.exe C:\Users\Admin\AppData\Roaming\igcc.exe

Processes

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\e3f883dc3b401f7232adb797186f47b2d037951afb8cae4f80db0f9cb532b59e.xls

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" -Embedding

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding

C:\Users\Admin\AppData\Roaming\igcc.exe

"C:\Users\Admin\AppData\Roaming\igcc.exe"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\Users\Admin\AppData\Roaming\igcc.exe

"C:\Users\Admin\AppData\Roaming\igcc.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 ln.run udp
US 104.21.90.204:80 ln.run tcp
US 104.21.90.204:443 ln.run tcp
US 198.23.227.213:80 198.23.227.213 tcp
US 104.21.90.204:80 ln.run tcp
US 104.21.90.204:80 ln.run tcp
US 104.21.90.204:80 ln.run tcp
US 104.21.90.204:80 ln.run tcp
US 104.21.90.204:443 ln.run tcp
US 104.21.90.204:80 ln.run tcp
US 104.21.90.204:443 ln.run tcp
US 198.23.227.213:80 198.23.227.213 tcp
US 198.23.227.213:80 198.23.227.213 tcp

Files

memory/2220-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/2220-1-0x00000000723ED000-0x00000000723F8000-memory.dmp

memory/2628-19-0x000000002F2B1000-0x000000002F2B2000-memory.dmp

memory/2628-21-0x00000000723ED000-0x00000000723F8000-memory.dmp

memory/2220-24-0x0000000002ED0000-0x0000000002ED2000-memory.dmp

memory/2628-23-0x0000000003640000-0x0000000003642000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\{1AFF126F-3020-4418-93EF-25C372913F79}

MD5 20070aaea1398667c9a82070be991216
SHA1 c94fa86b61a37bcb166af520fbab40f322a8cda4
SHA256 56d77f50a4d71e0848dbeaf0b26af3426ae3973efc36b1333ec19a3ec5f78644
SHA512 2f31b7f0c0f468f58657a856451e2f03dc5f2d448f682401b40a78d71350a5cfdb7c587fe4b0da50aa09b124010438a944f5a9f77a80eb6630155090007d857a

C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-{0A09C009-FBDA-4B53-BA28-0CBCE9463EAE}.FSD

MD5 719fad39af378d728d95807b1d480b69
SHA1 1f614477ae80ed4f827b06cb6e15250abcefe6e7
SHA256 3eb3bed060ebbe58caffdaedd8748eafd7286ef93a706edf8e6ede437e2b39e4
SHA512 99e2e34e1040f7e17f10dd4f5d9252dc4844c6ed2a4364e9e03a5ce7119e58a12ba385ab19848ec4f8f73c03d36f22eac15008dab4da16f9ed461ea659418d27

C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD

MD5 a27d4ea817f42bfa1100edf2ca6ae8f0
SHA1 f72d8cdeee7bc512a5b1e24e874f3be0b3739418
SHA256 50dc82277e63266179f9e7f0ce76ee640a68b6bd09e8f669d584cd717286e261
SHA512 4fa58e467d2809093204176aab7400cef322d9f06e4e9a09e03812232b777ec182e2134950f0fabe16825e65f7c3ebbaa53f6eba2e504be5720e639c8866b7dc

C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-{D4DDDDF4-4C73-47BA-A6FB-E8C5C5EA2042}.FSD

MD5 d2df983bb3762ec90d79af6716cb6f38
SHA1 2ba2191835d3c0c29854122896a268974a3ea1d4
SHA256 d4ca75217c987929af05257fac9c0bc62ee557df0dd22f7aa8940666dde80caf
SHA512 ee49d06b5d74bce45821523793b50ef4a5fd8abb8a046e6e7488d4f5bb6630b96dcde43bb7184f91f8aea8afe62d9b81d10f1469586b57bbe4ba04bf4e0b1e91

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H09CVCL3\lionsarekingofthejunglewhoruletheworldtounderstandhowmuchpowerfulthelionsarekingofthejungleneitreworldintogetitback___thinkthejungleoflionsare[1].doc

MD5 c5858e4c690557b5240597db6e4d88c9
SHA1 055c0f300481f028f283c2c822af1746469c2676
SHA256 b9be32df7c17dd87021dc2ebb56b1c4ea4b453e3e0d7072dfa572e416cb161a2
SHA512 fbc7abc3c991d7d49c663aa8f8eae1ce47e4d703f55267dbbb2d1601b9d0d265feb96c78b92b6e6c29b519a2b5f12576924be5050faa94eb56f0fac2304d80b0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 aa08ec878b05196c518d4db7d55e371b
SHA1 349148372278a8cb178f3ecd9fc827797db9ed91
SHA256 7a1ba6bbe0ce1e04178103a593cf3dfd6db1c1acbac1e028544c0848c030df22
SHA512 c2ec69ee95370317b02a79758a80f43c59d896efd3f432916b3d6c9a2af39d528347dd9358950a8100115a3967a8a0d2bdd0c14e121b63798618b8dc5103b201

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 9224ece9968ce8a51ca6c2fc81de88e2
SHA1 67b0532514d3005d98c988e26d3ef63bdcf4fd13
SHA256 59100fd4aed5ba0f0cc079ec15a8000feb6027b7956c310c8cea5dee7b6b2f58
SHA512 b3d36ed5966af0b32fcb97195c65e0aeb10bcf09c62957c754de7a792cdcb9791bfb672f3fb0be061069114a993c77a7de3a45383eaa080544dfbc375f08e1ba

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 526f3c769c478e2c058075a35fc62e7f
SHA1 616cd3f447385d065b65ea2aa38c30cd37ffb187
SHA256 c7f2eccda8e0301881d2742783b357844a2448518e1c90e91770903ab3e7d39b
SHA512 dc4d860f9eb0f7ed40d87fc3e129080ad9cb052853b2d6d52e9dbcd85bb4866b3a2e9e8b25c1b713d6d9bc41435e24fa4bdb30f86b9e9826a591a54f0c1f00a3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 8202a1cd02e7d69597995cabbe881a12
SHA1 8858d9d934b7aa9330ee73de6c476acf19929ff6
SHA256 58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA512 97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 287d6aa106a19681c4ecbdf776ef80c0
SHA1 9aa22fcb243d6e214feced4016a3c06920ef1ff8
SHA256 6551416ec0c26c5df22729b20824627f1d8293477ad57689e36daddd8ed1b0bc
SHA512 845059eddb72d02034c7b67b30f0edcb2e20ea6f3cf6f76810cc0990412a1efbbdda7fde024bfbae330d2beaf378db9e5418d1a7f57850068b6a6580f9b7a6f2

C:\Users\Admin\AppData\Local\Temp\Cab3A63.tmp

MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

\Users\Admin\AppData\Roaming\igcc.exe

MD5 2e1fea17aeea8852800f17ead782ca53
SHA1 34a1bc065cd9413b783ad9e0e78d2996415186a4
SHA256 d2f23dc9b7b97472f7996e14c836b6571e23c79ee585d6d4c8f13ef7ae101d6e
SHA512 93f8af036ac8f9be2a63e0717499f96d5c8f5ce5dc0a1c1e3ac4a09dee33c305aa602d93007a8b97e15d2b637fbbe819fb53b631d37b1123caa9e5f8622e9e83

memory/268-127-0x00000000008D0000-0x00000000009C2000-memory.dmp

memory/268-129-0x0000000005200000-0x000000000529E000-memory.dmp

memory/268-130-0x00000000004E0000-0x00000000004F6000-memory.dmp

memory/2220-131-0x00000000723ED000-0x00000000723F8000-memory.dmp

memory/268-132-0x0000000000550000-0x000000000055E000-memory.dmp

memory/268-133-0x00000000008B0000-0x00000000008C0000-memory.dmp

memory/268-134-0x00000000054C0000-0x0000000005542000-memory.dmp

memory/676-135-0x0000000000400000-0x0000000000440000-memory.dmp

memory/676-144-0x0000000000400000-0x0000000000440000-memory.dmp

memory/676-147-0x0000000000400000-0x0000000000440000-memory.dmp

memory/676-146-0x0000000000400000-0x0000000000440000-memory.dmp

memory/676-143-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/676-141-0x0000000000400000-0x0000000000440000-memory.dmp

memory/676-139-0x0000000000400000-0x0000000000440000-memory.dmp

memory/676-137-0x0000000000400000-0x0000000000440000-memory.dmp

memory/2628-148-0x00000000723ED000-0x00000000723F8000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

MD5 2d342f829a3dde26e999bb67e46de03d
SHA1 75bcf0a769901e40a9e0e5eb4bc7c373175246a4
SHA256 84ddcb3d38e1438d15a897486de2d5762c6cf2a40bb1816d8e48b0636cf28490
SHA512 0e695340c1223db4b0367c16c7b9e468db55f9192e5ee201d1453df113f42d6c5d58566bac8e2d3b55b61681a128e996bc51b495fb0315abf26b68ea7868a764

memory/2628-170-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/2628-171-0x00000000723ED000-0x00000000723F8000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-04 01:25

Reported

2024-06-04 01:28

Platform

win10v2004-20240508-en

Max time kernel

148s

Max time network

141s

Command Line

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\e3f883dc3b401f7232adb797186f47b2d037951afb8cae4f80db0f9cb532b59e.xls"

Signatures

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAuditPrivilege N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4788 wrote to memory of 3580 N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE C:\Windows\splwow64.exe
PID 4788 wrote to memory of 3580 N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE C:\Windows\splwow64.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy WMI provider

ransomware

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\e3f883dc3b401f7232adb797186f47b2d037951afb8cae4f80db0f9cb532b59e.xls"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1032,i,13640054265074968359,8146127767143474550,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:8

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" -Embedding

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc

Network

Country Destination Domain Proto
US 8.8.8.8:53 46.28.109.52.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 roaming.officeapps.live.com udp
GB 52.109.32.7:443 roaming.officeapps.live.com tcp
US 8.8.8.8:53 ln.run udp
US 104.21.90.204:80 ln.run tcp
US 8.8.8.8:53 7.32.109.52.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 104.21.90.204:443 ln.run tcp
US 8.8.8.8:53 204.90.21.104.in-addr.arpa udp
US 8.8.8.8:53 35.169.217.172.in-addr.arpa udp
US 198.23.227.213:80 198.23.227.213 tcp
US 8.8.8.8:53 213.227.23.198.in-addr.arpa udp
US 104.21.90.204:80 ln.run tcp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 104.21.90.204:80 ln.run tcp
US 104.21.90.204:80 ln.run tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 104.21.90.204:80 ln.run tcp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 104.21.90.204:80 ln.run tcp
US 104.21.90.204:80 ln.run tcp
US 104.21.90.204:443 ln.run tcp
US 198.23.227.213:80 198.23.227.213 tcp
US 104.21.90.204:80 ln.run tcp
US 8.8.8.8:53 174.117.168.52.in-addr.arpa udp
US 104.21.90.204:443 ln.run tcp
US 198.23.227.213:80 198.23.227.213 tcp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 metadata.templates.cdn.office.net udp
NL 23.62.61.162:443 metadata.templates.cdn.office.net tcp
US 8.8.8.8:53 binaries.templates.cdn.office.net udp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 8.8.8.8:53 162.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 17.251.17.2.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 101.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 28.73.42.20.in-addr.arpa udp

Files

memory/436-0-0x00007FFA0E310000-0x00007FFA0E320000-memory.dmp

memory/436-3-0x00007FFA4E32D000-0x00007FFA4E32E000-memory.dmp

memory/436-2-0x00007FFA0E310000-0x00007FFA0E320000-memory.dmp

memory/436-1-0x00007FFA0E310000-0x00007FFA0E320000-memory.dmp

memory/436-5-0x00007FFA0E310000-0x00007FFA0E320000-memory.dmp

memory/436-4-0x00007FFA0E310000-0x00007FFA0E320000-memory.dmp

memory/436-6-0x00007FFA4E290000-0x00007FFA4E485000-memory.dmp

memory/436-9-0x00007FFA4E290000-0x00007FFA4E485000-memory.dmp

memory/436-11-0x00007FFA4E290000-0x00007FFA4E485000-memory.dmp

memory/436-10-0x00007FFA4E290000-0x00007FFA4E485000-memory.dmp

memory/436-8-0x00007FFA4E290000-0x00007FFA4E485000-memory.dmp

memory/436-7-0x00007FFA4E290000-0x00007FFA4E485000-memory.dmp

memory/436-13-0x00007FFA4E290000-0x00007FFA4E485000-memory.dmp

memory/436-14-0x00007FFA0C2B0000-0x00007FFA0C2C0000-memory.dmp

memory/436-12-0x00007FFA4E290000-0x00007FFA4E485000-memory.dmp

memory/436-15-0x00007FFA0C2B0000-0x00007FFA0C2C0000-memory.dmp

memory/436-16-0x00007FFA4E290000-0x00007FFA4E485000-memory.dmp

memory/436-18-0x00007FFA4E290000-0x00007FFA4E485000-memory.dmp

memory/436-19-0x00007FFA4E290000-0x00007FFA4E485000-memory.dmp

memory/436-17-0x00007FFA4E290000-0x00007FFA4E485000-memory.dmp

memory/4788-44-0x00007FFA4E290000-0x00007FFA4E485000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\523F6363-1C68-49F0-A491-F94BCAC93EA2

MD5 f359f3d4b7420996b9dab5da1a393d94
SHA1 2e61d20c3a83bdd44e8ecc237c4066563cebca6a
SHA256 845f6d4c4a220e4e781d8e0858e37fabbf59a7e0c1658a8deef0185dc3621746
SHA512 accd3f7806225073afd463f10635e82c61fd83cfe8846de4c7771d192b4414c36027e1329bc457b394f5a2635e7ca5af9f24bc76267c723ae5de3cc4e0fd0001

C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres

MD5 108086a36a594665b0d5fe06ac6f0244
SHA1 037ef5c9c564837cf8b54df19d0bb56eb6a7a0b6
SHA256 15e524f8f24ca5acf252cc7fa950daed4459ef8f11a6470bdd80ad8c008d3297
SHA512 58aea7022f9bc1e72b9e7adb10d4b55a7ebbf3c98cdc95363b09cbf00df7e133099928b877572cbed871ae1857dceec9a57fe8210219566c0514efe5b02d89ed

C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

MD5 5a8d2b6fa1267d020ae0bd7e6f44ce31
SHA1 9195d356e3e70ee89c7c53d868c0820ed89afea9
SHA256 283aec5768de84dd5cf0aca03927395731cdf857ea43649a5ffe5ea778d69673
SHA512 9f8881ff0435b9dd89a9c6ef05ecb7aa1a6f69269b6ee3e1b7950cbc417a63b1254c3688c09db1505827f5090a0276e9f347032878a5bd01369ff92003b4f098

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7UY3WOJS\lionsarekingofthejunglewhoruletheworldtounderstandhowmuchpowerfulthelionsarekingofthejungleneitreworldintogetitback___thinkthejungleoflionsare[1].doc

MD5 c5858e4c690557b5240597db6e4d88c9
SHA1 055c0f300481f028f283c2c822af1746469c2676
SHA256 b9be32df7c17dd87021dc2ebb56b1c4ea4b453e3e0d7072dfa572e416cb161a2
SHA512 fbc7abc3c991d7d49c663aa8f8eae1ce47e4d703f55267dbbb2d1601b9d0d265feb96c78b92b6e6c29b519a2b5f12576924be5050faa94eb56f0fac2304d80b0

C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

MD5 2ea5e18dd1a77ce53285f015684e3804
SHA1 6623ab9eec15de411857ceed061652d3a44cb4a2
SHA256 bb32e2283d506eea7e4b6d8907e2e9ba36a5811973fcf2605d5808ee1cdaa674
SHA512 03c9650c68dbcae81459c8f54c0a98fba53e63c8093fea8c40c528049f6d31d9878d100e9bc29baeed898380f996139b3399c5acbc810d220ced88b2b42e41b4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 8202a1cd02e7d69597995cabbe881a12
SHA1 8858d9d934b7aa9330ee73de6c476acf19929ff6
SHA256 58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA512 97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 21fd5245810ab947f129237ad01c9da0
SHA1 fa22caf4341cce66c4e61697702f3882e2f16fc8
SHA256 1ccf067dce0d4bc6359d03a581c2c03fe0d85e55e0c3bc603c8e44999d7c7ad3
SHA512 1ec76502a25e0fd26978329edc7fbf8da2dc0a47a665b8ba9a45364c8004972770a0da31882c5d853161bc6ea1e1c00ae7a23e458aa9e30af188c64dfd09c2fe

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 aa08ec878b05196c518d4db7d55e371b
SHA1 349148372278a8cb178f3ecd9fc827797db9ed91
SHA256 7a1ba6bbe0ce1e04178103a593cf3dfd6db1c1acbac1e028544c0848c030df22
SHA512 c2ec69ee95370317b02a79758a80f43c59d896efd3f432916b3d6c9a2af39d528347dd9358950a8100115a3967a8a0d2bdd0c14e121b63798618b8dc5103b201

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 e88a4b8b62467c1325882abf0581bb06
SHA1 31c1e7a87416fcb28305bdd7f7e4ff86d94b5e25
SHA256 1de1995c23a35b4dcc9248d7c0bc7127e4c0bdaa9540961c21bb0e74e378a234
SHA512 ee70a834fac259da48975be706fe142d712101d78eba905a07c5ee71679d239ca4840e33c3a27eeed4b0f9f7cde86f5ec7e29b48ba621f7b2dcfe648006aaf61

C:\Users\Admin\AppData\Local\Microsoft\Office\DLP\mip\logs\mip_sdk.miplog

MD5 89b39a699620dc080224bd1c96f23170
SHA1 b2ebd8a1c8514e05c24b0314c074bd871927b48c
SHA256 62f82eaadd3a9762fea4056c698b7b36ac588b4520c2c801f41482f86719251f
SHA512 f83ec97fafe738e2dd9299354522cd576d9d672c9851cb1fe33fb61628e53e61801bfadd09f06aefc148a8bef6b54c3e440ecf4c863beb9e35fc94cb4dc6c260

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04

MD5 a5def322ae3bcb46dd581247b0003843
SHA1 525eb52274100a359aad1563b7480672ff70626c
SHA256 3c74af94e549a7ee5d7fed213e3c2a06a03d8a5d4ebfd076a2704b2f0d354f8a
SHA512 09f711c0b299fdef07155ece6956560e1d42f5ce6c3ff9fa8691b15fad91d76bc4050bf6ad2219a3b2845ec891b17388b88eb2f5d5c6f2dec67ff9c58bd6b2f3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04

MD5 8724ce8bec4b98b48ce4061ca8e9799b
SHA1 3802632acf4817809db62516c8a03584d983ca54
SHA256 4a37f017c8d38e88d6b0c25decf9fc65168e34b689608134c5171e285355507e
SHA512 2e3f6b45707d19ed68bf8cb83cf4188e7a8a014e4960786e6fff1f14cfb413853da635b00b358857aa242934671a8ffd5b4f6799025ee810cef5f3191e214cca

C:\Users\Admin\AppData\Local\Temp\TCD3E1A.tmp\sist02.xsl

MD5 f883b260a8d67082ea895c14bf56dd56
SHA1 7954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA256 ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
SHA512 d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

MD5 d7d6cdcfbfa7b557f6350ec166e0c64b
SHA1 8ff782364a96d58ec75f98e9d2fb4bec76db7185
SHA256 1b79c7598b6f72394258f2e446887fb84f9ac34499bec48084ae4c8af76d09a6
SHA512 b34694d545dfb865b46146a379e809dbd0200bef4c18aad25cd8eed72df579eeed9c57362da98271dd998762d8d76a51b119837a92a337612eab2100bdf4c8d5

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

MD5 0a63ad85a04b53022ebfb8d3e4ebbd47
SHA1 465105307b08c4ed4058e88793e47f440c802528
SHA256 0b9b436368231c78d87ba0f57cd709430b6394ef2f5ee86b86dc2d088015148f
SHA512 25d20bb18a3e44aa0fb86f0d7b937cbcdbdb4daee00f2387265f2039feb9576e454df42811f4d42a5d132b8665a58d7c2474078d1764fd0be47292f4d7448f7a

memory/436-573-0x00007FFA4E290000-0x00007FFA4E485000-memory.dmp

memory/4788-574-0x00007FFA4E290000-0x00007FFA4E485000-memory.dmp