Automated Malware Analysis IOC Report for

Files

File Path

Type

Processes

Path

Cmdline

Malicious

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding

C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding

C:\Users\user\AppData\Roaming\taskhostw.exe

"C:\Users\user\AppData\Roaming\taskhostw.exe"

C:\Users\user\AppData\Local\directory\name.exe

"C:\Users\user\AppData\Roaming\taskhostw.exe"

C:\Windows\SysWOW64\svchost.exe

"C:\Users\user\AppData\Roaming\taskhostw.exe"

C:\Windows\SysWOW64\svchost.exe

C:\Windows\SysWOW64\svchost.exe /stext "C:\Users\user\AppData\Local\Temp\siqmroydgnmmmfpuczimwafbeumewarjhx"

C:\Windows\SysWOW64\svchost.exe

C:\Windows\SysWOW64\svchost.exe /stext "C:\Users\user\AppData\Local\Temp\ckvxrh"

C:\Windows\SysWOW64\svchost.exe

C:\Windows\SysWOW64\svchost.exe /stext "C:\Users\user\AppData\Local\Temp\feapszuyi"

C:\Windows\System32\wscript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs"

C:\Users\user\AppData\Local\directory\name.exe

"C:\Users\user\AppData\Local\directory\name.exe"

C:\Windows\SysWOW64\svchost.exe

"C:\Users\user\AppData\Local\directory\name.exe"

C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding

There are 2 hidden processes, click here to show them.

URLs

Name

Malicious

http://104.168.7.25/350/taskhostw.exej

unknown

http://104.168.7.25/350/taskhostw.exennC:

unknown

http://104.168.7.25/350/taskhostw.exe&c

unknown

http://104.168.7.25/350/taskhostw.exe

104.168.7.25

http://geoplugin.net/json.gp

178.237.33.50

107.173.4.16

http://b.scorecardresearch.com/beacon.js

unknown

http://acdn.adnxs.com/ast/ast.js

unknown

http://www.imvu.comr

unknown

http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_167%2Cw_312%2Cc_fill%2Cg_faces%2Ce_

unknown

https://contextual.media.net/medianet.php?cid=8CUT39MWR&crid=715624197&size=306x271&https=1

unknown

https://support.google.com

unknown

https://support.google.com/chrome/?p=plugin_flash

unknown

http://cdn.taboola.com/libtrc/static/thumbnails/f539211219b796ffbb49949997c764f0.png

unknown

https://cvision.media.net/new/286x175/2/137/169/197/852af93e-e705-48f1-93ba-6ef64c8308e6.jpg?v=9

unknown

http://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html

unknown

http://www.nirsoft.net

unknown

https://deff.nelreports.net/api/report?cat=msn

unknown

https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.9.1.min.js

unknown

http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com

unknown

http://cache.btrll.com/default/Pix-1x1.gif

unknown

http://pr-bh.ybp.yahoo.com/sync/msft/1614522055312108683

unknown

https://www.google.com

unknown

http://geoplugin.net/json.gp/C

unknown

http://o.aolcdn.com/ads/adswrappermsni.js

unknown

http://cdn.taboola.com/libtrc/msn-home-network/loader.js

unknown

http://www.msn.com/?ocid=iehp

unknown

https://www.msn.com/en-us/homepage/secure/silentpassport?secure=false&lc=1033

unknown

http://static.chartbeat.com/js/chartbeat.js

unknown

http://www.msn.com/de-de/?ocid=iehp

unknown

http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_90%2Cw_120%2Cc_fill%2Cg_faces:auto%

unknown

http://www.nirsoft.net/

unknown

https://contextual.media.net/803288796/fcmain.js?&gdpr=1&cid=8CUT39MWR&cpcd=2K6DOtg60bLnBhB3D4RSbQ%3

unknown

http://p.rfihub.com/cm?in=1&pub=345&userid=1614522055312108683

unknown

http://ib.adnxs.com/pxj?bidder=18&seg=378601&action=setuids(

unknown

https://cvision.media.net/new/286x175/3/72/42/210/948f45db-f5a0-41ce-a6b6-5cc9e8c93c16.jpg?v=9

unknown

http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_80%2Ch_334%2Cw_312%2Cc_fill%2Cg_faces%2Ce_sh

unknown

http://cdn.taboola.com/libtrc/impl.thin.277-63-RELEASE.js

unknown

https://www.ccleaner.com/go/app_cc_pro_trialkey

unknown

https://contextual.media.net/8/nrrV73987.js

unknown

http://www.imvu.com

unknown

https://contextual.media.net/

unknown

http://widgets.outbrain.com/external/publishers/msn/MSNIdSync.js

unknown

https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBSKZM1Y&prvid=77%2

unknown

http://www.msn.com/

unknown

https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_311%2Cw_207%2Cc_fill%2Cg_faces:au

unknown

https://dc.ads.linkedin.com/collect/?pid=6883&opid=7850&fmt=gif&ck=&3pc=true&an_user_id=591650497549

unknown

http://www.imvu.com/Y

unknown

http://cdn.at.atwola.com/_media/uac/msn.html

unknown

http://dis.criteo.com/dis/usersync.aspx?r=7&p=3&cp=appnexus&cu=1&url=http%3A%2F%2Fib.adnxs.com%2Fset

unknown

https://policies.yahoo.com/w3c/p3p.xml

unknown

http://www.msn.com/advertisement.ad.js

unknown

http://www.ebuddy.com

unknown

There are 43 hidden URLs, click here to show them.

Domains

Name

Malicious

geoplugin.net

178.237.33.50

Details

Name:	geoplugin.net
IP:	178.237.33.50
TargetID:	7
Current Path:	C:\Windows\SysWOW64\svchost.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
System process connects to network (likely due to code injection or exploit)	Networking, HIPS / PFW / Operating System Protection Evasion	Process Injection
HTTP GET or POST without a user agent	Networking
Potential document exploit detected (performs DNS queries)	Software Vulnerabilities	Exploitation for Client Execution
Potential document exploit detected (performs HTTP gets)	Software Vulnerabilities	Exploitation for Client Execution
Suricata IDS alerts with low severity for network traffic	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

104.168.7.25

unknown

United States

Details

IP:	104.168.7.25
TargetID:	2
Current Path:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Country:	United States
Countrycode:	USA
ASN number:	36352
ASN name:	AS-COLOCROSSINGUS
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: EQNEDT32.EXE connecting to internet	Exploits
Suricata IDS alerts for network traffic	Networking
Office equation editor establishes network connection	Exploits	Exploitation for Client Execution
Sigma detected: Equation Editor Network Connection	System Summary
Potential document exploit detected (performs HTTP gets)	Software Vulnerabilities	Exploitation for Client Execution
Potential document exploit detected (unknown TCP traffic)	Software Vulnerabilities	Exploitation for Client Execution
Uses a known web browser user agent for HTTP communication	Networking	Application Layer Protocol
Connects to IPs without corresponding DNS lookups	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
URLs found in memory or binary data	Networking

107.173.4.16

unknown

United States

Details

IP:	107.173.4.16
TargetID:	7
Current Path:	C:\Windows\SysWOW64\svchost.exe
Country:	United States
Countrycode:	USA
ASN number:	36352
ASN name:	AS-COLOCROSSINGUS
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Suricata IDS alerts for network traffic	Networking
System process connects to network (likely due to code injection or exploit)	Networking, HIPS / PFW / Operating System Protection Evasion	Process Injection
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port

178.237.33.50

geoplugin.net

Netherlands

Details

IP:	178.237.33.50
TargetID:	7
Current Path:	C:\Windows\SysWOW64\svchost.exe
Country:	Netherlands
Countrycode:	NLD
ASN number:	8455
ASN name:	ATOM86-ASATOM86NL
Private:	false
Domain:	geoplugin.net

Signature Hits	Behavior Group	Mitre Attack
System process connects to network (likely due to code injection or exploit)	Networking, HIPS / PFW / Operating System Protection Evasion	Process Injection
Potential document exploit detected (performs HTTP gets)	Software Vulnerabilities	Exploitation for Client Execution
Suricata IDS alerts with low severity for network traffic	Networking

Registry

Path

Value

Malicious

HKEY_CURRENT_USER\Software\Rmc-FI789R

exepath

HKEY_CURRENT_USER\Software\Rmc-FI789R

licence

HKEY_CURRENT_USER\Software\Rmc-FI789R

time

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

yd/

HKEY_CURRENT_USER\Software\Microsoft\Shared Tools\Outlook\Journaling\Microsoft Word

Enabled

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word

MTTT

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

1e/

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

+f/

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\ReviewCycle

ReviewToken

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\DocumentRecovery\2908C

2908C