IOC Report
PO-00006799868.xls

PO-00006799868.xls

Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Thu Oct 10 12:40:54 2024, Security: 1

initial sample

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\taskhostw[1].exe

PE32 executable (GUI) Intel 80386, for MS Windows

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{8ACACCBE-F49B-438C-81AF-59EF5D64236E}.tmp

Composite Document File V2 Document, Cannot read section info

dropped

C:\Users\user\AppData\Local\directory\name.exe

PE32 executable (GUI) Intel 80386, for MS Windows

dropped

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\7al0eY.url

MS Windows 95 Internet shortcut text (URL=<https://shuvi.io/7al0eY>), ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\shuvi.io.url

MS Windows 95 Internet shortcut text (URL=<https://shuvi.io/>), ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs

data

dropped

C:\Users\user\AppData\Roaming\taskhostw.exe

PE32 executable (GUI) Intel 80386, for MS Windows

dropped

C:\Users\user\Desktop\PO-00006799868.xls (copy)

Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Sat Oct 12 15:40:15 2024, Security: 1

dropped

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" -Embedding

C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding

C:\Users\user\AppData\Roaming\taskhostw.exe

"C:\Users\user\AppData\Roaming\taskhostw.exe"

C:\Users\user\AppData\Local\directory\name.exe

"C:\Users\user\AppData\Roaming\taskhostw.exe"

C:\Windows\SysWOW64\svchost.exe

"C:\Users\user\AppData\Roaming\taskhostw.exe"

C:\Windows\SysWOW64\svchost.exe

C:\Windows\SysWOW64\svchost.exe /stext "C:\Users\user\AppData\Local\Temp\slsrkklvishzfgljivqawntxyxjphjjhhw"

C:\Windows\SysWOW64\svchost.exe

C:\Windows\SysWOW64\svchost.exe /stext "C:\Users\user\AppData\Local\Temp\dnxjld"

C:\Windows\SysWOW64\svchost.exe

C:\Windows\SysWOW64\svchost.exe /stext "C:\Users\user\AppData\Local\Temp\nhlcmvhqk"

C:\Windows\System32\wscript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs"

http://104.168.7.25/450/taskhostw.exennC:

unknown

http://104.168.7.25/450/taskhostw.exe

104.168.7.25

http://104.168.7.25/450/taskhostw.exegu4

unknown

http://104.168.7.25/450/taskhostw.exedv

unknown

http://geoplugin.net/json.gp

178.237.33.50

http://104.168.7.25/xampp/ew/wecreatednewthigsforsuccessfulljournecyr________verynicepeoplesetirethigstogoformegreat________________nnicwaytoentreithigntochangewithmegreat.doc

104.168.7.25

http://104.168.7.25/450/taskhostw.exej

unknown

107.173.4.16