Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
Inquiry N TM24-10-09.xlam.xlsx
|
Microsoft Excel 2007+
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\ng5th[1].exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Temp\zwuonypqu.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\Desktop\~$Inquiry N TM24-10-09.xlam.xlsx
|
data
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Temp\derogates
|
data
|
dropped
|
||
|
C:\Users\user\Desktop\~$Inquiry N TM24-10-09.xlam.xls
|
data
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
|
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
|
|
|
|
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
|
"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
|
|
|
|
C:\Users\user\AppData\Local\Temp\zwuonypqu.exe
|
C:\Users\user\AppData\Local\Temp\zwuonypqu.exe
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
|
C:\Users\user\AppData\Local\Temp\zwuonypqu.exe
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://eficienciaeningenieria.com.mx/vnkl/ng5th.exe
|
104.21.53.112
|
|
|
|
http://eficienciaeningenieria.com.mx/vnkl/ng5th.exej
|
unknown
|
||
|
https://account.dyn.com/
|
unknown
|
||
|
http://eficienciaeningenieria.com.mx/vnkl/ng5th.exejjC:
|
unknown
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
eficienciaeningenieria.com.mx
|
104.21.53.112
|
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
104.21.53.112
|
eficienciaeningenieria.com.mx
|
United States
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
|
m+/
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Shared Tools\Outlook\Journaling\Microsoft Excel
|
Enabled
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel
|
MTTT
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\ReviewCycle
|
ReviewToken
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
|
.0/
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Security\Trusted Documents
|
LastPurgeTime
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
|
1033
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
|
1033
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
|
EXCELFiles
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
|
ProductFiles
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
|
VBAFiles
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109E60090400100000000F01FEC\Usage
|
EquationEditorFilesIntl_1033
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109E60090400100000000F01FEC\Usage
|
EquationEditorFilesIntl_1033
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
|
SavedLegacySettings
|
There are 4 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
310000
|
direct allocation
|
page read and write
|
|
|
|
402000
|
system
|
page execute and read and write
|
|
|
|
67C0000
|
heap
|
page read and write
|
||
|
3531000
|
heap
|
page read and write
|
||
|
34B0000
|
heap
|
page read and write
|
||
|
98A000
|
heap
|
page read and write
|
||
|
646E000
|
stack
|
page read and write
|
||
|
3530000
|
heap
|
page execute and read and write
|
||
|
A80000
|
heap
|
page read and write
|
||
|
964000
|
heap
|
page read and write
|
||
|
9BA000
|
heap
|
page read and write
|
||
|
397000
|
heap
|
page read and write
|
||
|
A87000
|
heap
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
34FB000
|
heap
|
page read and write
|
||
|
18D000
|
trusted library allocation
|
page execute and read and write
|
||
|
3DE0000
|
direct allocation
|
page read and write
|
||
|
3DF1000
|
direct allocation
|
page read and write
|
||
|
5F6E000
|
stack
|
page read and write
|
||
|
3E60000
|
direct allocation
|
page read and write
|
||
|
34FB000
|
heap
|
page read and write
|
||
|
34FB000
|
heap
|
page read and write
|
||
|
321F000
|
stack
|
page read and write
|
||
|
3535000
|
heap
|
page read and write
|
||
|
82E000
|
stack
|
page read and write
|
||
|
3E60000
|
direct allocation
|
page read and write
|
||
|
2B5E000
|
stack
|
page read and write
|
||
|
4520000
|
heap
|
page execute and read and write
|
||
|
620F000
|
stack
|
page read and write
|
||
|
900000
|
heap
|
page read and write
|
||
|
34FB000
|
heap
|
page read and write
|
||
|
752000
|
heap
|
page read and write
|
||
|
2566000
|
heap
|
page read and write
|
||
|
3660000
|
heap
|
page read and write
|
||
|
2F2000
|
heap
|
page read and write
|
||
|
339E000
|
heap
|
page read and write
|
||
|
3BA0000
|
direct allocation
|
page read and write
|
||
|
353E000
|
heap
|
page read and write
|
||
|
34FB000
|
heap
|
page read and write
|
||
|
10000
|
heap
|
page read and write
|
||
|
900000
|
heap
|
page read and write
|
||
|
948000
|
heap
|
page read and write
|
||
|
2B1E000
|
stack
|
page read and write
|
||
|
65E000
|
stack
|
page read and write
|
||
|
3438000
|
heap
|
page read and write
|
||
|
5EED000
|
stack
|
page read and write
|
||
|
603F000
|
heap
|
page read and write
|
||
|
3BA0000
|
direct allocation
|
page read and write
|
||
|
3DF4000
|
direct allocation
|
page read and write
|
||
|
466E000
|
stack
|
page read and write
|
||
|
24CF000
|
stack
|
page read and write
|
||
|
34FB000
|
heap
|
page read and write
|
||
|
34FB000
|
heap
|
page read and write
|
||
|
3DF4000
|
direct allocation
|
page read and write
|
||
|
3DF4000
|
direct allocation
|
page read and write
|
||
|
36A1000
|
heap
|
page read and write
|
||
|
3CF0000
|
direct allocation
|
page read and write
|
||
|
3D00000
|
direct allocation
|
page read and write
|
||
|
5F2C000
|
stack
|
page read and write
|
||
|
2BB8000
|
heap
|
page read and write
|
||
|
3CF0000
|
direct allocation
|
page read and write
|
||
|
34FB000
|
heap
|
page read and write
|
||
|
490000
|
unkown
|
page write copy
|
||
|
3E60000
|
direct allocation
|
page read and write
|
||
|
290000
|
heap
|
page read and write
|
||
|
6054000
|
heap
|
page read and write
|
||
|
192000
|
trusted library allocation
|
page read and write
|
||
|
36B1000
|
heap
|
page read and write
|
||
|
5FAF000
|
stack
|
page read and write
|
||
|
B0000
|
trusted library allocation
|
page read and write
|
||
|
3542000
|
heap
|
page read and write
|
||
|
34FB000
|
heap
|
page read and write
|
||
|
3DF1000
|
direct allocation
|
page read and write
|
||
|
3A6000
|
trusted library allocation
|
page read and write
|
||
|
2BE000
|
stack
|
page read and write
|
||
|
34FB000
|
heap
|
page read and write
|
||
|
959000
|
heap
|
page read and write
|
||
|
907000
|
heap
|
page read and write
|
||
|
3DF1000
|
direct allocation
|
page read and write
|
||
|
3E00000
|
direct allocation
|
page read and write
|
||
|
3370000
|
heap
|
page read and write
|
||
|
4BDF000
|
stack
|
page read and write
|
||
|
32A0000
|
heap
|
page read and write
|
||
|
3C7A000
|
direct allocation
|
page read and write
|
||
|
34FB000
|
heap
|
page read and write
|
||
|
244000
|
heap
|
page read and write
|
||
|
3DF7000
|
direct allocation
|
page read and write
|
||
|
676F000
|
stack
|
page read and write
|
||
|
34FB000
|
heap
|
page read and write
|
||
|
3C7A000
|
direct allocation
|
page read and write
|
||
|
34FB000
|
heap
|
page read and write
|
||
|
19A000
|
trusted library allocation
|
page execute and read and write
|
||
|
2BB4000
|
heap
|
page read and write
|
||
|
3DE0000
|
direct allocation
|
page read and write
|
||
|
7EF40000
|
trusted library allocation
|
page execute and read and write
|
||
|
89F000
|
stack
|
page read and write
|
||
|
3C7A000
|
direct allocation
|
page read and write
|
||
|
180000
|
trusted library allocation
|
page read and write
|
||
|
8B4000
|
stack
|
page read and write
|
||
|
8CE000
|
stack
|
page read and write
|
||
|
3427000
|
heap
|
page read and write
|
||
|
2B60000
|
heap
|
page read and write
|
||
|
200000
|
trusted library allocation
|
page read and write
|
||
|
7BB000
|
heap
|
page read and write
|
||
|
3DF1000
|
direct allocation
|
page read and write
|
||
|
3A0000
|
trusted library allocation
|
page read and write
|
||
|
656C000
|
stack
|
page read and write
|
||
|
3E60000
|
direct allocation
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
3D00000
|
direct allocation
|
page read and write
|
||
|
3DE0000
|
direct allocation
|
page read and write
|
||
|
34FB000
|
heap
|
page read and write
|
||
|
34FB000
|
heap
|
page read and write
|
||
|
34FB000
|
heap
|
page read and write
|
||
|
3451000
|
trusted library allocation
|
page read and write
|
||
|
3DF7000
|
direct allocation
|
page read and write
|
||
|
36E6000
|
heap
|
page read and write
|
||
|
C4000
|
trusted library allocation
|
page read and write
|
||
|
1A2000
|
trusted library allocation
|
page read and write
|
||
|
34FB000
|
heap
|
page read and write
|
||
|
6C0000
|
heap
|
page read and write
|
||
|
3E0000
|
trusted library allocation
|
page execute and read and write
|
||
|
4AB000
|
unkown
|
page readonly
|
||
|
5FB0000
|
heap
|
page read and write
|
||
|
3536000
|
heap
|
page read and write
|
||
|
3DE0000
|
direct allocation
|
page read and write
|
||
|
6230000
|
heap
|
page read and write
|
||
|
3E60000
|
direct allocation
|
page read and write
|
||
|
34FB000
|
heap
|
page read and write
|
||
|
34FB000
|
heap
|
page read and write
|
||
|
3BA0000
|
direct allocation
|
page read and write
|
||
|
236F000
|
stack
|
page read and write
|
||
|
3C7A000
|
direct allocation
|
page read and write
|
||
|
34FB000
|
heap
|
page read and write
|
||
|
243D000
|
heap
|
page read and write
|
||
|
782000
|
heap
|
page read and write
|
||
|
400000
|
system
|
page execute and read and write
|
||
|
3419000
|
heap
|
page read and write
|
||
|
236E000
|
stack
|
page read and write | page guard
|
||
|
34FA000
|
heap
|
page read and write
|
||
|
CD000
|
trusted library allocation
|
page execute and read and write
|
||
|
3DF4000
|
direct allocation
|
page read and write
|
||
|
3E00000
|
direct allocation
|
page read and write
|
||
|
3535000
|
heap
|
page read and write
|
||
|
1AB000
|
trusted library allocation
|
page execute and read and write
|
||
|
3E60000
|
direct allocation
|
page read and write
|
||
|
370000
|
heap
|
page read and write
|
||
|
448000
|
trusted library allocation
|
page read and write
|
||
|
4AB000
|
unkown
|
page readonly
|
||
|
3DE000
|
stack
|
page read and write
|
||
|
34FB000
|
heap
|
page read and write
|
||
|
599E000
|
stack
|
page read and write
|
||
|
3E00000
|
direct allocation
|
page read and write
|
||
|
8F7000
|
heap
|
page read and write
|
||
|
36A1000
|
heap
|
page read and write
|
||
|
36E7000
|
heap
|
page read and write
|
||
|
34FB000
|
heap
|
page read and write
|
||
|
4940000
|
heap
|
page read and write
|
||
|
2D0000
|
heap
|
page read and write
|
||
|
1DF0000
|
direct allocation
|
page read and write
|
||
|
18A000
|
stack
|
page read and write
|
||
|
2506000
|
trusted library allocation
|
page read and write
|
||
|
34FB000
|
heap
|
page read and write
|
||
|
636F000
|
stack
|
page read and write
|
||
|
34FB000
|
heap
|
page read and write
|
||
|
680000
|
heap
|
page read and write
|
||
|
4A7000
|
unkown
|
page read and write
|
||
|
240000
|
heap
|
page read and write
|
||
|
6E4000
|
heap
|
page read and write
|
||
|
342F000
|
heap
|
page read and write
|
||
|
C0000
|
trusted library allocation
|
page read and write
|
||
|
3DF7000
|
direct allocation
|
page read and write
|
||
|
A6E000
|
stack
|
page read and write
|
||
|
3CF0000
|
direct allocation
|
page read and write
|
||
|
6010000
|
heap
|
page read and write
|
||
|
2BB0000
|
heap
|
page read and write
|
||
|
3DF7000
|
direct allocation
|
page read and write
|
||
|
34FB000
|
heap
|
page read and write
|
||
|
4AA4000
|
heap
|
page read and write
|
||
|
2D1E000
|
stack
|
page read and write
|
||
|
10A000
|
stack
|
page read and write
|
||
|
3DF1000
|
direct allocation
|
page read and write
|
||
|
602D000
|
heap
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
914000
|
heap
|
page read and write
|
||
|
3CF0000
|
direct allocation
|
page read and write
|
||
|
34FB000
|
heap
|
page read and write
|
||
|
3CF0000
|
direct allocation
|
page read and write
|
||
|
4AC2000
|
heap
|
page read and write
|
||
|
289F000
|
stack
|
page read and write
|
||
|
6C7000
|
heap
|
page read and write
|
||
|
34FB000
|
heap
|
page read and write
|
||
|
70E000
|
heap
|
page read and write
|
||
|
704000
|
heap
|
page read and write
|
||
|
924000
|
heap
|
page read and write
|
||
|
3DE0000
|
direct allocation
|
page read and write
|
||
|
3DF7000
|
direct allocation
|
page read and write
|
||
|
4F0000
|
heap
|
page execute and read and write
|
||
|
34FB000
|
heap
|
page read and write
|
||
|
1A7000
|
trusted library allocation
|
page execute and read and write
|
||
|
34FB000
|
heap
|
page read and write
|
||
|
196000
|
trusted library allocation
|
page execute and read and write
|
||
|
34FB000
|
heap
|
page read and write
|
||
|
68D000
|
stack
|
page read and write
|
||
|
559E000
|
unkown
|
page read and write
|
||
|
710000
|
heap
|
page read and write
|
||
|
23CF000
|
stack
|
page read and write
|
||
|
3E00000
|
direct allocation
|
page read and write
|
||
|
34FB000
|
heap
|
page read and write
|
||
|
604F000
|
heap
|
page read and write
|
||
|
353B000
|
heap
|
page read and write
|
||
|
490000
|
unkown
|
page read and write
|
||
|
34FB000
|
heap
|
page read and write
|
||
|
340F000
|
heap
|
page read and write
|
||
|
AF0000
|
heap
|
page execute and read and write
|
||
|
C3000
|
trusted library allocation
|
page execute and read and write
|
||
|
34FB000
|
heap
|
page read and write
|
||
|
3DF1000
|
direct allocation
|
page read and write
|
||
|
96B000
|
heap
|
page read and write
|
||
|
390000
|
trusted library allocation
|
page read and write
|
||
|
276000
|
heap
|
page read and write
|
||
|
2BBB000
|
heap
|
page read and write
|
||
|
24E8000
|
trusted library allocation
|
page read and write
|
||
|
3DE0000
|
direct allocation
|
page read and write
|
||
|
1E0000
|
trusted library allocation
|
page read and write
|
||
|
3E00000
|
direct allocation
|
page read and write
|
||
|
2E0000
|
heap
|
page read and write
|
||
|
262000
|
heap
|
page read and write
|
||
|
34B0000
|
heap
|
page read and write
|
||
|
2503000
|
trusted library allocation
|
page read and write
|
||
|
299F000
|
stack
|
page read and write
|
||
|
34FB000
|
heap
|
page read and write
|
||
|
34FB000
|
heap
|
page read and write
|
||
|
34FB000
|
heap
|
page read and write
|
||
|
34FB000
|
heap
|
page read and write
|
||
|
3E00000
|
direct allocation
|
page read and write
|
||
|
3C7A000
|
direct allocation
|
page read and write
|
||
|
23DE000
|
stack
|
page read and write
|
||
|
390000
|
heap
|
page read and write
|
||
|
8F0000
|
heap
|
page read and write
|
||
|
3C7D000
|
direct allocation
|
page read and write
|
||
|
34FB000
|
heap
|
page read and write
|
||
|
3520000
|
heap
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
34FB000
|
heap
|
page read and write
|
||
|
34FB000
|
heap
|
page read and write
|
||
|
3220000
|
heap
|
page read and write
|
||
|
8EE000
|
stack
|
page read and write
|
||
|
3D00000
|
direct allocation
|
page read and write
|
||
|
666F000
|
stack
|
page read and write
|
||
|
33CB000
|
heap
|
page read and write
|
||
|
3DF7000
|
direct allocation
|
page read and write
|
||
|
34FB000
|
heap
|
page read and write
|
||
|
3C7D000
|
direct allocation
|
page read and write
|
||
|
3BA0000
|
direct allocation
|
page read and write
|
||
|
34FB000
|
heap
|
page read and write
|
||
|
539E000
|
stack
|
page read and write
|
||
|
5200000
|
heap
|
page read and write
|
||
|
3C7A000
|
direct allocation
|
page read and write
|
||
|
482000
|
unkown
|
page readonly
|
||
|
2D4000
|
heap
|
page read and write
|
||
|
967000
|
heap
|
page read and write
|
||
|
89D000
|
stack
|
page read and write
|
||
|
34FB000
|
heap
|
page read and write
|
||
|
503C000
|
stack
|
page read and write
|
||
|
2410000
|
heap
|
page read and write
|
||
|
3C7D000
|
direct allocation
|
page read and write
|
||
|
3DF4000
|
direct allocation
|
page read and write
|
||
|
10000
|
heap
|
page read and write
|
||
|
34FB000
|
heap
|
page read and write
|
||
|
3BA0000
|
direct allocation
|
page read and write
|
||
|
34FB000
|
heap
|
page read and write
|
||
|
32E000
|
stack
|
page read and write
|
||
|
1D0000
|
trusted library allocation
|
page execute and read and write
|
||
|
3DF4000
|
direct allocation
|
page read and write
|
||
|
740000
|
heap
|
page read and write
|
||
|
370F000
|
heap
|
page read and write
|
||
|
5FD0000
|
heap
|
page read and write
|
||
|
34FB000
|
heap
|
page read and write
|
||
|
34FB000
|
heap
|
page read and write
|
||
|
100000
|
heap
|
page read and write
|
||
|
8B000
|
stack
|
page read and write
|
||
|
3C7D000
|
direct allocation
|
page read and write
|
||
|
3D00000
|
direct allocation
|
page read and write
|
||
|
370F000
|
heap
|
page read and write
|
||
|
10000
|
heap
|
page read and write
|
||
|
270000
|
heap
|
page read and write
|
||
|
8AF000
|
stack
|
page read and write
|
||
|
91F000
|
heap
|
page read and write
|
||
|
3C7D000
|
direct allocation
|
page read and write
|
||
|
2DF000
|
stack
|
page read and write
|
||
|
36A1000
|
heap
|
page read and write
|
||
|
190000
|
trusted library allocation
|
page read and write
|
||
|
3C7D000
|
direct allocation
|
page read and write
|
||
|
3CF0000
|
direct allocation
|
page read and write
|
||
|
9B2000
|
heap
|
page read and write
|
||
|
4AA0000
|
heap
|
page read and write
|
||
|
540000
|
heap
|
page read and write
|
||
|
388000
|
stack
|
page read and write
|
||
|
28E000
|
stack
|
page read and write
|
||
|
3AA0000
|
heap
|
page read and write
|
||
|
34FB000
|
heap
|
page read and write
|
||
|
3479000
|
trusted library allocation
|
page read and write
|
||
|
63E000
|
stack
|
page read and write
|
||
|
34FB000
|
heap
|
page read and write
|
||
|
34FB000
|
heap
|
page read and write
|
||
|
36D000
|
stack
|
page read and write
|
||
|
966000
|
heap
|
page read and write
|
||
|
243F000
|
heap
|
page read and write
|
||
|
1A5000
|
trusted library allocation
|
page execute and read and write
|
||
|
482000
|
unkown
|
page readonly
|
||
|
36A1000
|
heap
|
page read and write
|
||
|
3518000
|
heap
|
page read and write
|
||
|
89000
|
stack
|
page read and write
|
||
|
51EE000
|
stack
|
page read and write
|
||
|
5700000
|
heap
|
page read and write
|
||
|
2451000
|
trusted library allocation
|
page read and write
|
||
|
24EE000
|
trusted library allocation
|
page read and write
|
||
|
2D20000
|
heap
|
page read and write
|
||
|
2560000
|
heap
|
page read and write
|
||
|
92E000
|
heap
|
page read and write
|
||
|
3BA0000
|
direct allocation
|
page read and write
|
||
|
3D00000
|
direct allocation
|
page read and write
|
||
|
22E000
|
stack
|
page read and write
|
||
|
3D00000
|
direct allocation
|
page read and write
|
||
|
2420000
|
heap
|
page read and write
|
||
|
36A0000
|
heap
|
page read and write
|
There are 317 hidden memdumps, click here to show them.