Spreadsheet analysis links executable launch to matching local files
Excel launched an executable from a user’s Windows Templates directory while analysis also recorded a request for an executable at `www.bagsrad.com`. The request suggests a delivery source but does not prove what was downloaded; recovered configuration and matching traffic instead support `mirrowingviewnet.ydns.eu:5203` as the Warzone-associated control endpoint.
Excel launched an executable from a user’s Windows Templates directory while analysis of the same spreadsheet recorded a request for an .exe file on www.bagsrad.com. But the remote endpoint recovered from memory was elsewhere: mirrowingviewnet.ydns.eu:5203. Which address supplied the program, and which was intended to control it? The evidence supports different roles, with different levels of certainty.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read