IOC Report
PO-008847332.xlam.xlsx

loading gif

Files

File Path
Type
Category
Malicious
PO-008847332.xlam.xlsx
Microsoft Excel 2007+
initial sample
 malicious
C:\Users\user\AppData\Local\Temp\xyjhromj.exe
HTML document, ASCII text, with very long lines (4070)
dropped
 malicious
C:\Users\user\Desktop\~$PO-008847332.xlam.xlsx
data
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\suspendedpage[1].htm
HTML document, ASCII text, with very long lines (4070)
dropped
C:\Users\user\Desktop\~$PO-008847332.xlam.xls
data
dropped

Processes

Path
Cmdline
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
 malicious
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
 malicious

URLs

Name
IP
Malicious
http://eficienciaeningenieria.com.mx/kdeplu/ngoct2.exe
104.21.53.112
 malicious
http://eficienciaeningenieria.com.mx/cgi-sys/suspendedpage.cgi
104.21.53.112
 malicious
http://eficienciaeningenieria.com.mx/kdeplu/ngoct2.exej
unknown
http://eficienciaeningenieria.com.mx/cgi-sys/suspendedpage.cgiB
unknown
http://eficienciaeningenieria.com.mx/cgi-sys/suspendedpage.cgis
unknown

Domains

Name
IP
Malicious
eficienciaeningenieria.com.mx
104.21.53.112
 malicious

IPs

IP
Domain
Country
Malicious
104.21.53.112
eficienciaeningenieria.com.mx
United States
malicious

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
5b/
HKEY_CURRENT_USER\Software\Microsoft\Shared Tools\Outlook\Journaling\Microsoft Excel
Enabled
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel
MTTT
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\ReviewCycle
ReviewToken
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
{h/
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Security\Trusted Documents
LastPurgeTime
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
1033
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
EXCELFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
ProductFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
VBAFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109E60090400100000000F01FEC\Usage
EquationEditorFilesIntl_1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109E60090400100000000F01FEC\Usage
EquationEditorFilesIntl_1033
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
SavedLegacySettings
There are 4 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
767E000
stack
page read and write
7680000
heap
page read and write
3570000
heap
page read and write
3585000
heap
page read and write
77BF000
stack
page read and write
23B2000
heap
page read and write
676000
heap
page read and write
783F000
stack
page read and write
291F000
stack
page read and write
2394000
heap
page read and write
6AC000
heap
page read and write
89000
stack
page read and write
7CBF000
stack
page read and write
281E000
stack
page read and write
7ABC000
stack
page read and write
77FC000
stack
page read and write
7BBF000
stack
page read and write
2BDE000
stack
page read and write
2C00000
heap
page read and write
18A000
stack
page read and write
8B0000
heap
page read and write
63E000
heap
page read and write
79BE000
stack
page read and write
600000
heap
page read and write
10000
heap
page read and write
2B9F000
stack
page read and write
607000
heap
page read and write
74F4000
heap
page read and write
2A9E000
stack
page read and write
2C08000
heap
page read and write
7880000
heap
page read and write
240000
heap
page read and write
75EE000
stack
page read and write
336000
heap
page read and write
677000
heap
page read and write
5C0000
heap
page read and write
62F000
heap
page read and write
27DF000
stack
page read and write
1E50000
direct allocation
page read and write
36D000
heap
page read and write
668000
heap
page read and write
2390000
heap
page read and write
7600000
heap
page read and write
74B0000
heap
page read and write
330000
heap
page read and write
624000
heap
page read and write
74DF000
heap
page read and write
8B7000
heap
page read and write
787F000
stack
page read and write
74EF000
heap
page read and write
673000
heap
page read and write
2C04000
heap
page read and write
7E80000
heap
page read and write
26DD000
stack
page read and write
74CD000
heap
page read and write
228E000
stack
page read and write
238F000
stack
page read and write
58F000
stack
page read and write
3EF000
stack
page read and write
74AD000
stack
page read and write
7CE0000
heap
page read and write
2C0B000
heap
page read and write
There are 52 hidden memdumps, click here to show them.