5ad401c3...90b7 | IOCs
Logo
Try VMRay Analyzer
VTI SCORE: 95/100
Dynamic Analysis Report
Classification:
Keylogger
Dropper
Threat Names: -

Council-of-Europe-.xls

Excel Document

Created at 2020-04-08T20:44:00

...

Indicators

File (30)
»
Filename Hash Operations Category Severity
C:\Users\aETAdzjz\Desktop\Council-of-Europe-.xls MD5: c89eb0682aa568b8f3d8e5cde23e1fed
SHA1: 35463c4d947f4a275416b22dd6a271fd0c99d94e
SHA256: 5ad401c3a568bd87dd13f8a9ddc4e450ece61cd9ce4d1b23f68ce0b1f3c190b7
SSDeep: 12288:P8RFy14R0yPXfaVhf8xUAuoTf4suMg5dBvPeiA7hJdf9NudvZt0dzzs97Z7KPMme:x4RO
ImpHash: - 		Sample File
Malicious
C:\ProgramData\DataExchange.dll MD5: 959e28f5cb3fea8299bf2fe3ec268ebb
SHA1: 6c5ff79550fb4c0acc71c3c6da3dc5afe6fea822
SHA256: 2361ee9c49fbe2a6302b3b01c1cc5893359ccee2782be42976d9e6f5efb14d84
SSDeep: 3072:dLLijkWk0Uj1HxOob/90B7JdNHZUsfLcG+EcskoGmlu6gAg0FubPyyjBnas1UaAB:dmkzkPNys4G+EcsyAOj/jBhiaY
ImpHash: 4efff83e30680d340096e552cf53aedc 		Access, Create, Write Dropped File
Unknown
C:\ProgramData\tt.bat MD5: 36dc19d145b4b39a24150055080e47bf
SHA1: e02effb961a3e9d8994f21b008e959045465f03c
SHA256: 8f93f7e1f6865e41ae718899718fb4ff9116d5986eb83a7fe6dad54595d4fb02
SSDeep: 3:28D9so3KRfyM1K7eDBFaRwRyid4JL4AcfDKCkRERrcKaov:rtuH1jGwUidYkjfao1jv
ImpHash: - 		Access, Create, Write Dropped File
Unknown
C:\ - Access
Not Available
C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7.1\VBE7.DLL - Access
Not Available
C:\Users - Access
Not Available
C:\Users\aETAdzjz - Access
Not Available
C:\Users\aETAdzjz\Desktop - Access
Not Available
C:\Users\aETAdzjz\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1 - Access
Not Available
C:\Users\aETAdzjz\Documents\WindowsPowerShell\profile.ps1 - Access
Not Available
C:\Windows\SysWOW64\rundll32.exe - Access
Not Available
C:\Windows\System32\WindowsPowerShell\v1.0 - Access
Not Available
C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml - Access
Not Available
C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml - Access
Not Available
C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml - Access
Not Available
C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml - Access
Not Available
C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml - Access, Read
Not Available
C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml - Access
Not Available
C:\Windows\System32\WindowsPowerShell\v1.0\Microsoft.PowerShell_profile.ps1 - Access
Not Available
C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml - Access
Not Available
C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml - Access
Not Available
C:\Windows\System32\WindowsPowerShell\v1.0\Registry.format.ps1xml - Access
Not Available
C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml - Access, Read
Not Available
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.config - Access
Not Available
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - Access
Not Available
C:\Windows\System32\WindowsPowerShell\v1.0\profile.ps1 - Access
Not Available
C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml - Access
Not Available
C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll - Access
Not Available
C:\Windows\system32\cmd.exe - Access
Not Available
C:\Windows\system32\rundll32.exe - Access
Not Available
Registry (83)
»
Registry Key Name Operations
HKEY_CLASSES_ROOT\Licenses Access
HKEY_CLASSES_ROOT\Licenses\8804558B-B773-11d1-BC3E-0000F87552E7 Access, Read
HKEY_CLASSES_ROOT\TypeLib Access
HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046} Access
HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0 Access
HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0 Access
HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0\win64 Access, Read
HKEY_CLASSES_ROOT\TypeLib\{00020813-0000-0000-C000-000000000046} Access
HKEY_CLASSES_ROOT\TypeLib\{00020813-0000-0000-C000-000000000046}\1.9 Access
HKEY_CLASSES_ROOT\TypeLib\{00020813-0000-0000-C000-000000000046}\1.9\0 Access
HKEY_CLASSES_ROOT\TypeLib\{00020813-0000-0000-C000-000000000046}\1.9\0\win64 Access, Read
HKEY_CLASSES_ROOT\TypeLib\{00020813-0000-0000-C000-000000000046}\1.9\409 Access
HKEY_CLASSES_ROOT\TypeLib\{00020813-0000-0000-C000-000000000046}\1.9\9 Access
HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52} Access
HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8 Access
HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8\0 Access
HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8\0\win64 Access, Read
HKEY_CURRENT_USER\Environment Access
HKEY_CURRENT_USER\Environment\PSMODULEPATH Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor Access
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\AutoRun Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\CompletionChar Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DefaultColor Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DelayedExpansion Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DisableUNCCheck Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\EnableExtensions Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\PathCompletionChar Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common Access, Create
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\BackGroundCompile Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\BreakOnAllErrors Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\BreakOnServerErrors Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\CompileOnDemand Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\NotifyUserBeforeStateLoss Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\RequireDeclaration Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\VbaCapability Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System Access
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Access, Create
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\AutoStart Access, Read, Write
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell\ApplicationBase Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell\StackVersion Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell\path Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\PipelineMaxStackSizeMB Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\StackVersion Access, Read
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents\PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer\PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service\PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center\PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts\PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\AutoRun Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\CompletionChar Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DefaultColor Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DelayedExpansion Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DisableUNCCheck Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\EnableExtensions Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\PathCompletionChar Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell Access
HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine Access
HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine\ApplicationBase Access, Read
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment Access
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment\PSMODULEPATH Access, Read
HKEY_PERFORMANCE_DATA Access
System Access
System\PowerShell Access
Windows PowerShell Access
Windows PowerShell\PowerShell Access
Domain (7)
»
Domain Sources Severity
000000000000000000000000000000000000000000000000000s00-c8pf60.investpro.best Function Log
Unknown
00005-7719009ae6838a31c8282c804263c85c000000000000063q-c8pf60.investpro.best Function Log
Unknown
0001336576687862616a6569000000000000000000000000000e2w-c8pf60.investpro.best Function Log
Unknown
000266b9e6e5b9f9902cb411fb149c3a77ffbaadd8280jf-c8pf60.investpro.best Function Log
Unknown
000361455441647a6a7a404030303163356131366337633140403hsb-c8pf60.investpro.best Function Log
Unknown
0004139322e3136382e302e323131404057696e646f7773203740opf-c8pf60.investpro.best Function Log
Unknown
000540594b5944363951un7-c8pf60.investpro.best Function Log
Unknown
Export to TXT Export to JSON
VMRay - Analyzer - www.vmray.com
Legal Note
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image