IOC Report
Packing List - SAPPHIRE X.xlsx.scr.exe

loading gif

Files

File Path
Type
Category
Malicious
Packing List - SAPPHIRE X.xlsx.scr.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Packing List - SAPPHIRE X.xlsx.scr.exe.log
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_43e24mry.5r1.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fbxqcxop.gbs.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nqjzv3tp.qrv.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xukhuikw.5mf.psm1
ASCII text, with no line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\Packing List - SAPPHIRE X.xlsx.scr.exe
"C:\Users\user\Desktop\Packing List - SAPPHIRE X.xlsx.scr.exe"
 malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Packing List - SAPPHIRE X.xlsx.scr.exe"
malicious
C:\Users\user\Desktop\Packing List - SAPPHIRE X.xlsx.scr.exe
"C:\Users\user\Desktop\Packing List - SAPPHIRE X.xlsx.scr.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
https://api.ipify.org/
172.67.74.152
http://www.apache.org/licenses/LICENSE-2.0
unknown
http://www.fontbureau.com
unknown
http://www.fontbureau.com/designersG
unknown
http://www.fontbureau.com/designers/?
unknown
http://www.founder.com.cn/cn/bThe
unknown
https://account.dyn.com/
unknown
http://www.fontbureau.com/designers?
unknown
http://www.tiro.com
unknown
http://www.fontbureau.com/designers
unknown
http://www.goodfont.co.kr
unknown
https://api.ipify.org/t
unknown
http://www.carterandcone.coml
unknown
http://www.sajatypeworks.com
unknown
http://www.typography.netD
unknown
http://www.fontbureau.com/designers/cabarga.htmlN
unknown
http://www.founder.com.cn/cn/cThe
unknown
http://www.galapagosdesign.com/staff/dennis.htm
unknown
https://api.ipify.org
unknown
http://www.founder.com.cn/cn
unknown
http://www.fontbureau.com/designers/frere-user.html
unknown
http://www.jiyu-kobo.co.jp/
unknown
http://www.galapagosdesign.com/DPlease
unknown
http://www.fontbureau.com/designers8
unknown
http://www.fonts.com
unknown
http://www.sandoll.co.kr
unknown
http://www.urwpp.deDPlease
unknown
http://www.zhongyicts.com.cn
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://www.sakkal.com
unknown
http://beirutrest.com
unknown
There are 21 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
beirutrest.com
50.87.144.157
api.ipify.org
172.67.74.152

IPs

IP
Domain
Country
Malicious
50.87.144.157
beirutrest.com
United States
172.67.74.152
api.ipify.org
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Packing List - SAPPHIRE X_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Packing List - SAPPHIRE X_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Packing List - SAPPHIRE X_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Packing List - SAPPHIRE X_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Packing List - SAPPHIRE X_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Packing List - SAPPHIRE X_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Packing List - SAPPHIRE X_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Packing List - SAPPHIRE X_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Packing List - SAPPHIRE X_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Packing List - SAPPHIRE X_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Packing List - SAPPHIRE X_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Packing List - SAPPHIRE X_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Packing List - SAPPHIRE X_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Packing List - SAPPHIRE X_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
402000
remote allocation
page execute and read and write
 malicious
59A0000
trusted library section
page read and write
 malicious
4235000
trusted library allocation
page read and write
 malicious
3011000
trusted library allocation
page read and write
 malicious
303C000
trusted library allocation
page read and write
 malicious
41F9000
trusted library allocation
page read and write
 malicious
7C4E000
stack
page read and write
6B60000
trusted library allocation
page read and write
6EF0000
trusted library allocation
page execute and read and write
6EA0000
trusted library allocation
page read and write
7CCE000
stack
page read and write
56E0000
trusted library allocation
page execute and read and write
61CE000
heap
page read and write
720E000
stack
page read and write
3050000
trusted library allocation
page execute and read and write
1294000
heap
page read and write
11BB000
trusted library allocation
page execute and read and write
2EE6000
trusted library allocation
page execute and read and write
5810000
heap
page read and write
52EB000
stack
page read and write
787E000
stack
page read and write
1250000
heap
page read and write
7F80000
heap
page read and write
67F3000
heap
page read and write
67E9000
heap
page read and write
BB5E000
stack
page read and write
7300000
trusted library allocation
page read and write
10D5000
heap
page read and write
1240000
heap
page read and write
7B30000
trusted library allocation
page read and write
5BC0000
trusted library allocation
page read and write
2F41000
trusted library allocation
page read and write
7C8E000
stack
page read and write
5970000
trusted library allocation
page read and write
EBA000
stack
page read and write
1220000
heap
page read and write
BA5E000
stack
page read and write
6EE0000
heap
page read and write
7F50000
heap
page read and write
1325000
heap
page read and write
2F68000
trusted library allocation
page read and write
55F0000
heap
page read and write
7AB0000
trusted library section
page read and write
10B0000
heap
page read and write
1250000
trusted library allocation
page read and write
125E000
heap
page read and write
1600000
trusted library allocation
page read and write
1230000
trusted library allocation
page execute and read and write
7F6E000
heap
page read and write
56C0000
heap
page read and write
11E0000
trusted library allocation
page read and write
171F000
stack
page read and write
3060000
trusted library allocation
page read and write
1247000
heap
page read and write
7B4B000
trusted library allocation
page read and write
3090000
trusted library allocation
page read and write
5BD0000
trusted library allocation
page read and write
6B17000
trusted library allocation
page read and write
2F3A000
trusted library allocation
page read and write
13A0000
heap
page read and write
11D0000
heap
page read and write
F38000
stack
page read and write
1130000
heap
page read and write
30B0000
trusted library allocation
page read and write
5680000
heap
page execute and read and write
6B5D000
stack
page read and write
C04E000
stack
page read and write
3095000
trusted library allocation
page read and write
2E04000
trusted library allocation
page read and write
7FB4000
heap
page read and write
1137000
heap
page read and write
2FC1000
trusted library allocation
page read and write
5634000
trusted library allocation
page read and write
1183000
trusted library allocation
page execute and read and write
2F9C000
stack
page read and write
6C60000
trusted library allocation
page read and write
D72000
unkown
page readonly
59C0000
heap
page read and write
C00E000
stack
page read and write
FB7000
stack
page read and write
1268000
heap
page read and write
5600000
heap
page read and write
61A0000
heap
page read and write
15BD000
stack
page read and write
2E30000
heap
page read and write
1297000
heap
page read and write
61A9000
heap
page read and write
6C5E000
stack
page read and write
67B7000
heap
page read and write
400000
remote allocation
page execute and read and write
6B00000
trusted library allocation
page read and write
3040000
heap
page execute and read and write
7322000
trusted library allocation
page read and write
2F46000
trusted library allocation
page read and write
1610000
heap
page read and write
C14F000
stack
page read and write
11B7000
trusted library allocation
page execute and read and write
3FE9000
trusted library allocation
page read and write
6ED0000
heap
page read and write
7F2C0000
trusted library allocation
page execute and read and write
2FF6000
trusted library allocation
page read and write
2F2E000
trusted library allocation
page read and write
69EE000
stack
page read and write
6C1E000
stack
page read and write
6791000
heap
page read and write
2E10000
trusted library allocation
page read and write
11A2000
trusted library allocation
page read and write
157E000
stack
page read and write
1184000
trusted library allocation
page read and write
BDCE000
stack
page read and write
1240000
trusted library allocation
page read and write
6C70000
trusted library allocation
page read and write
1190000
trusted library allocation
page read and write
50BE000
stack
page read and write
3042000
trusted library allocation
page read and write
30A3000
heap
page read and write
BECE000
stack
page read and write
118D000
trusted library allocation
page execute and read and write
5700000
trusted library allocation
page read and write
62D0000
trusted library allocation
page execute and read and write
783E000
stack
page read and write
7700000
heap
page read and write
2EE2000
trusted library allocation
page read and write
3038000
trusted library allocation
page read and write
1260000
heap
page read and write
62CE000
stack
page read and write
2EC4000
trusted library allocation
page read and write
69AE000
stack
page read and write
F90000
heap
page read and write
1170000
trusted library allocation
page read and write
304E000
trusted library allocation
page read and write
6C67000
trusted library allocation
page read and write
11AA000
trusted library allocation
page execute and read and write
13A5000
heap
page read and write
3036000
trusted library allocation
page read and write
11B2000
trusted library allocation
page read and write
10AE000
stack
page read and write
2E48000
trusted library allocation
page read and write
31F1000
trusted library allocation
page read and write
5670000
trusted library allocation
page read and write
11A0000
trusted library allocation
page read and write
63ED000
stack
page read and write
2DFE000
stack
page read and write
324B000
trusted library allocation
page read and write
31EF000
stack
page read and write
3001000
trusted library allocation
page read and write
2FFF000
trusted library allocation
page read and write
6F10000
heap
page read and write
1140000
heap
page read and write
2EDD000
trusted library allocation
page execute and read and write
128A000
heap
page read and write
122E000
stack
page read and write
6E9E000
stack
page read and write
6B80000
trusted library allocation
page execute and read and write
12F8000
heap
page read and write
6AF8000
trusted library allocation
page read and write
119D000
trusted library allocation
page execute and read and write
563B000
trusted library allocation
page read and write
127E000
heap
page read and write
1304000
heap
page read and write
15C0000
heap
page read and write
3080000
trusted library allocation
page read and write
7F7C000
heap
page read and write
1230000
heap
page read and write
2F26000
trusted library allocation
page read and write
1180000
trusted library allocation
page read and write
4029000
trusted library allocation
page read and write
584C000
stack
page read and write
564E000
trusted library allocation
page read and write
6E5E000
stack
page read and write
2ECD000
trusted library allocation
page execute and read and write
64EF000
stack
page read and write
68AE000
stack
page read and write
5660000
trusted library allocation
page read and write
7880000
trusted library allocation
page execute and read and write
1293000
heap
page read and write
3256000
trusted library allocation
page read and write
2EC3000
trusted library allocation
page execute and read and write
12E7000
heap
page read and write
2EF7000
trusted library allocation
page execute and read and write
2EE0000
trusted library allocation
page read and write
5656000
trusted library allocation
page read and write
565D000
trusted library allocation
page read and write
62F5000
heap
page read and write
2F5E000
stack
page read and write
11D7000
heap
page read and write
2EF0000
trusted library allocation
page read and write
1286000
heap
page read and write
6770000
heap
page read and write
5651000
trusted library allocation
page read and write
5830000
trusted library allocation
page execute and read and write
2F10000
trusted library allocation
page read and write
5800000
trusted library section
page readonly
6B0D000
trusted library allocation
page read and write
41F1000
trusted library allocation
page read and write
2ED0000
trusted library allocation
page read and write
D70000
unkown
page readonly
C18C000
stack
page read and write
2E00000
trusted library allocation
page read and write
5400000
heap
page read and write
2F2B000
trusted library allocation
page read and write
BF0E000
stack
page read and write
2F1C000
stack
page read and write
6AF0000
trusted library allocation
page read and write
6B10000
trusted library allocation
page read and write
62E0000
trusted library allocation
page execute and read and write
5BBD000
stack
page read and write
57FB000
stack
page read and write
2EC0000
trusted library allocation
page read and write
5820000
heap
page read and write
6B70000
trusted library allocation
page execute and read and write
145E000
stack
page read and write
30A0000
heap
page read and write
3070000
trusted library allocation
page read and write
BC5F000
stack
page read and write
2F3E000
trusted library allocation
page read and write
138E000
stack
page read and write
11B5000
trusted library allocation
page execute and read and write
2F20000
trusted library allocation
page read and write
7F4E000
stack
page read and write
303C000
stack
page read and write
7B40000
trusted library allocation
page read and write
61E4000
heap
page read and write
56D0000
trusted library allocation
page read and write
30E0000
heap
page read and write
12DE000
heap
page read and write
11B0000
trusted library allocation
page read and write
12EB000
heap
page read and write
1291000
heap
page read and write
2EF2000
trusted library allocation
page read and write
10D0000
heap
page read and write
C28C000
stack
page read and write
3FC1000
trusted library allocation
page read and write
710D000
stack
page read and write
2F4D000
trusted library allocation
page read and write
55A0000
heap
page execute and read and write
2FB0000
heap
page execute and read and write
6E1E000
stack
page read and write
6190000
heap
page read and write
6AEE000
stack
page read and write
7FAA000
heap
page read and write
2EFB000
trusted library allocation
page execute and read and write
5603000
heap
page read and write
62F0000
heap
page read and write
E39000
stack
page read and write
11A6000
trusted library allocation
page execute and read and write
2EEA000
trusted library allocation
page execute and read and write
12CF000
heap
page read and write
30D0000
trusted library allocation
page read and write
300D000
trusted library allocation
page read and write
5630000
trusted library allocation
page read and write
7FD8000
heap
page read and write
2F32000
trusted library allocation
page read and write
303A000
trusted library allocation
page read and write
There are 244 hidden memdumps, click here to show them.