IOC Report
PO906-645S790768.xlam.xlsx

loading gif

Files

File Path
Type
Category
Malicious
PO906-645S790768.xlam.xlsx
Microsoft Excel 2007+
initial sample
 malicious
C:\Users\user\Desktop\~$PO906-645S790768.xlam.xlsx
data
dropped
 malicious
C:\Users\user\Desktop\~$PO906-645S790768.xlam.xls
data
dropped

Processes

Path
Cmdline
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
 malicious
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
 malicious

URLs

Name
IP
Malicious
http://plugsbreakers.top/voicxe/mynnft.exe
66.63.187.171
 malicious
http://plugsbreakers.top/voicxe/mynnft.exej
unknown
http://plugsbreakers.top/voicxe/mynnft.exeiEHT2T
unknown
http://plugsbreakers.top/voicxe/mynnft.exeQHU
unknown

Domains

Name
IP
Malicious
plugsbreakers.top
66.63.187.171
 malicious

IPs

IP
Domain
Country
Malicious
66.63.187.171
plugsbreakers.top
United States
malicious

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
t&/
HKEY_CURRENT_USER\Software\Microsoft\Shared Tools\Outlook\Journaling\Microsoft Excel
Enabled
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel
MTTT
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\ReviewCycle
ReviewToken
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
j*/
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Security\Trusted Documents
LastPurgeTime
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
1033
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
EXCELFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
ProductFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
VBAFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109E60090400100000000F01FEC\Usage
EquationEditorFilesIntl_1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109E60090400100000000F01FEC\Usage
EquationEditorFilesIntl_1033
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
SavedLegacySettings
There are 4 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
1E0000
heap
page read and write
89000
stack
page read and write
7C50000
heap
page read and write
1C1F000
stack
page read and write
2FD000
heap
page read and write
2E3000
heap
page read and write
2BAF000
stack
page read and write
795D000
stack
page read and write
7BEF000
stack
page read and write
7C2F000
stack
page read and write
7A9F000
heap
page read and write
1E40000
direct allocation
page read and write
2C24000
heap
page read and write
287000
heap
page read and write
35A3000
heap
page read and write
7AAF000
heap
page read and write
7A8D000
heap
page read and write
7F3E000
stack
page read and write
7AB4000
heap
page read and write
2CD000
heap
page read and write
1C9E000
stack
page read and write
7BAF000
stack
page read and write
7A70000
heap
page read and write
7DC0000
heap
page read and write
1E6000
heap
page read and write
79DE000
stack
page read and write
640000
heap
page read and write
280000
heap
page read and write
309000
heap
page read and write
813F000
stack
page read and write
1CB0000
heap
page read and write
1D64000
heap
page read and write
647000
heap
page read and write
21D000
heap
page read and write
7A1C000
stack
page read and write
251F000
stack
page read and write
29EF000
stack
page read and write
30E000
heap
page read and write
2A4000
heap
page read and write
18A000
stack
page read and write
7A30000
heap
page read and write
1D60000
heap
page read and write
2C2B000
heap
page read and write
1CFE000
stack
page read and write
8230000
heap
page read and write
2C28000
heap
page read and write
1D82000
heap
page read and write
7E00000
heap
page read and write
2AF000
heap
page read and write
833F000
stack
page read and write
803C000
stack
page read and write
10000
heap
page read and write
2C5000
heap
page read and write
1E30000
heap
page read and write
28EF000
stack
page read and write
2FE000
heap
page read and write
2C8000
heap
page read and write
1D3E000
stack
page read and write
2BED000
stack
page read and write
3590000
heap
page read and write
330000
heap
page read and write
2C20000
heap
page read and write
241F000
stack
page read and write
843F000
stack
page read and write
1C5D000
stack
page read and write
There are 55 hidden memdumps, click here to show them.