cfc6981de86af094cf3db2e7ae18d12e843ec0af676775163da859034b872f8f

General

Target

Pro-forma Da.xlsm
Size

48KB
MD5

1b9914f176f853c624ff4727bb45180a
SHA1

7da7342da3b8e83b2d8e3783d7044c42c23385f0
SHA256

cfc6981de86af094cf3db2e7ae18d12e843ec0af676775163da859034b872f8f
SHA512

b7072ab08115b8dbe9f1efed333fe0eb003be4ad9370115b7175b71c27e8f5faa1e582f48827a46b6b8e1e190be244342199e9bd460e47d80d99888123e86cd1

Score

10^/10

spyware

Malware Config

Signatures

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

EQNEDT32.EXEcmd.execscript.exeEXCEL.EXEcmd.execscript.exeb0zjyDTDj3.exe

description	pid	process	target process
PID 1528 wrote to memory of 1692	1528	EQNEDT32.EXE	cmd.exe
PID 1528 wrote to memory of 1692	1528	EQNEDT32.EXE	cmd.exe
PID 1528 wrote to memory of 1692	1528	EQNEDT32.EXE	cmd.exe
PID 1528 wrote to memory of 1692	1528	EQNEDT32.EXE	cmd.exe
PID 1692 wrote to memory of 1764	1692	cmd.exe	cscript.exe
PID 1692 wrote to memory of 1764	1692	cmd.exe	cscript.exe
PID 1692 wrote to memory of 1764	1692	cmd.exe	cscript.exe
PID 1692 wrote to memory of 1764	1692	cmd.exe	cscript.exe
PID 1764 wrote to memory of 1748	1764	cscript.exe	cmd.exe
PID 1764 wrote to memory of 1748	1764	cscript.exe	cmd.exe
PID 1764 wrote to memory of 1748	1764	cscript.exe	cmd.exe
PID 1764 wrote to memory of 1748	1764	cscript.exe	cmd.exe
PID 272 wrote to memory of 1916	272	EXCEL.EXE	cscript.exe
PID 272 wrote to memory of 1916	272	EXCEL.EXE	cscript.exe
PID 272 wrote to memory of 1916	272	EXCEL.EXE	cscript.exe
PID 1748 wrote to memory of 1856	1748	cmd.exe	cscript.exe
PID 1748 wrote to memory of 1856	1748	cmd.exe	cscript.exe
PID 1748 wrote to memory of 1856	1748	cmd.exe	cscript.exe
PID 1748 wrote to memory of 1856	1748	cmd.exe	cscript.exe
PID 1916 wrote to memory of 1076	1916	cscript.exe	b0zjyDTDj3.exe
PID 1916 wrote to memory of 1076	1916	cscript.exe	b0zjyDTDj3.exe
PID 1916 wrote to memory of 1076	1916	cscript.exe	b0zjyDTDj3.exe
PID 1916 wrote to memory of 1076	1916	cscript.exe	b0zjyDTDj3.exe
PID 1076 wrote to memory of 1792	1076	b0zjyDTDj3.exe	schtasks.exe
PID 1076 wrote to memory of 1792	1076	b0zjyDTDj3.exe	schtasks.exe
PID 1076 wrote to memory of 1792	1076	b0zjyDTDj3.exe	schtasks.exe
PID 1076 wrote to memory of 1792	1076	b0zjyDTDj3.exe	schtasks.exe
PID 1076 wrote to memory of 1900	1076	b0zjyDTDj3.exe	b0zjyDTDj3.exe
PID 1076 wrote to memory of 1900	1076	b0zjyDTDj3.exe	b0zjyDTDj3.exe
PID 1076 wrote to memory of 1900	1076	b0zjyDTDj3.exe	b0zjyDTDj3.exe
PID 1076 wrote to memory of 1900	1076	b0zjyDTDj3.exe	b0zjyDTDj3.exe
PID 1076 wrote to memory of 1900	1076	b0zjyDTDj3.exe	b0zjyDTDj3.exe
PID 1076 wrote to memory of 1900	1076	b0zjyDTDj3.exe	b0zjyDTDj3.exe
PID 1076 wrote to memory of 1900	1076	b0zjyDTDj3.exe	b0zjyDTDj3.exe
PID 1076 wrote to memory of 1900	1076	b0zjyDTDj3.exe	b0zjyDTDj3.exe
PID 1076 wrote to memory of 1900	1076	b0zjyDTDj3.exe	b0zjyDTDj3.exe

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cscript.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1916	272	cscript.exe	EXCEL.EXE

Blacklisted process makes network request 2 IoCs

Processes:

cscript.execscript.exe

flow pid process

1 1916 cscript.exe
2 1856 cscript.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

b0zjyDTDj3.exeb0zjyDTDj3.exe

description pid process

Token: SeDebugPrivilege 1076 b0zjyDTDj3.exe
Token: SeDebugPrivilege 1900 b0zjyDTDj3.exe
Office loads VBA resources, possible macro or embedded object present
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

272 EXCEL.EXE
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

EXCEL.EXEb0zjyDTDj3.exe

pid process

272 EXCEL.EXE
272 EXCEL.EXE
272 EXCEL.EXE
1900 b0zjyDTDj3.exe
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Executes dropped EXE 2 IoCs

Processes:

b0zjyDTDj3.exeb0zjyDTDj3.exe

pid process

1076 b0zjyDTDj3.exe
1900 b0zjyDTDj3.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1792 schtasks.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

b0zjyDTDj3.exe

description pid process target process

PID 1076 set thread context of 1900 1076 b0zjyDTDj3.exe b0zjyDTDj3.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

b0zjyDTDj3.exeb0zjyDTDj3.exe

pid process

1076 b0zjyDTDj3.exe
1900 b0zjyDTDj3.exe
1900 b0zjyDTDj3.exe
NTFS ADS 1 IoCs

Processes:

EXCEL.EXE

description ioc process

File created C:\programdata\asc.txt:script1.vbs EXCEL.EXE
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

flow	pid	process
1	1916	cscript.exe
2	1856	cscript.exe

description	pid	process
Token: SeDebugPrivilege	1076	b0zjyDTDj3.exe
Token: SeDebugPrivilege	1900	b0zjyDTDj3.exe

pid	process
272	EXCEL.EXE

pid	process
272	EXCEL.EXE
272	EXCEL.EXE
272	EXCEL.EXE
1900	b0zjyDTDj3.exe

pid	process
1076	b0zjyDTDj3.exe
1900	b0zjyDTDj3.exe

pid	process
1792	schtasks.exe

description	pid	process	target process
PID 1076 set thread context of 1900	1076	b0zjyDTDj3.exe	b0zjyDTDj3.exe

pid	process
1076	b0zjyDTDj3.exe
1900	b0zjyDTDj3.exe
1900	b0zjyDTDj3.exe

description	ioc	process
File created	C:\programdata\asc.txt:script1.vbs	EXCEL.EXE

Script User-Agent 2 IoCs

Processes:

description	flow	ioc
HTTP User-Agent header	2	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	1	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
exploit

Exploitation for Client Execution
T1203

Processes:

EQNEDT32.EXE

pid process

1528 EQNEDT32.EXE

pid	process
1528	EQNEDT32.EXE

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\Pro-forma Da.xlsm"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- NTFS ADS
PID:272

C:\Windows\System32\cscript.exe
"C:\Windows\System32\cscript.exe" C:\programdata\asc.txt:script1.vbs
2⤵
- Suspicious use of WriteProcessMemory
- Process spawned unexpected child process
- Blacklisted process makes network request
PID:1916

C:\programdata\b0zjyDTDj3.exe
C:\programdata\b0zjyDTDj3.exe
3⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:1076

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\enWFIQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCB49.tmp"
4⤵
- Creates scheduled task(s)
PID:1792

C:\programdata\b0zjyDTDj3.exe
"{path}"
4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1900

C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
1⤵
- Suspicious use of WriteProcessMemory
- Launches Equation Editor
PID:1528

C:\Windows\SysWOW64\cmd.exe
cmd /c ren %tmp%\mm v&cScrIPT %tmp%\v?..wsf C
2⤵
- Suspicious use of WriteProcessMemory
PID:1692

C:\Windows\SysWOW64\cscript.exe
cScrIPT C:\Users\Admin\AppData\Local\Temp\v?..wsf C
3⤵
- Suspicious use of WriteProcessMemory
PID:1764

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c cscript C:\Users\Admin\AppData\Local\Temp\xx.vbs
4⤵
- Suspicious use of WriteProcessMemory
PID:1748

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp\xx.vbs
5⤵
- Blacklisted process makes network request
PID:1856

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Exploitation for Client Execution

1

T1203

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\b0zjyDTDj3.exe

Download Submit
C:\ProgramData\b0zjyDTDj3.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\mm

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpCB49.tmp

Download Submit
C:\Users\Admin\AppData\Local\Temp\xx

Download Submit
C:\programdata\asc.txt:script1.vbs

Download Submit
C:\programdata\b0zjyDTDj3.exe

Download Submit
memory/272-3-0x00000000004BB000-0x00000000004C0000-memory.dmp

Filesize
20KB

Download
memory/1076-18-0x0000000000000000-0x0000000000000000-disk.dmp

Download
memory/1076-12-0x0000000000000000-mapping.dmp

Download
memory/1692-0-0x0000000000000000-mapping.dmp

Download
memory/1748-7-0x0000000000000000-mapping.dmp

Download
memory/1764-9-0x0000000002710000-0x0000000002714000-memory.dmp

Filesize
16KB

Download
memory/1764-2-0x0000000000000000-mapping.dmp

Download
memory/1792-19-0x0000000000000000-mapping.dmp

Download
memory/1856-10-0x0000000000000000-mapping.dmp

Download
memory/1856-15-0x0000000002790000-0x0000000002794000-memory.dmp

Filesize
16KB

Download
memory/1900-21-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1900-22-0x000000000044582E-mapping.dmp

Download
memory/1900-24-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1900-25-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1916-8-0x0000000000000000-mapping.dmp

Download
memory/1916-14-0x0000000002560000-0x0000000002564000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads