Analysis
-
max time kernel
149s -
max time network
9s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
26-11-2020 07:20
Static task
static1
Behavioral task
behavioral1
Sample
VOMAXTRADING.doc
Resource
win7v20201028
Behavioral task
behavioral2
Sample
VOMAXTRADING.doc
Resource
win10v20201028
General
-
Target
VOMAXTRADING.doc
-
Size
1.6MB
-
MD5
30244581b41accd77dab936571e0d87e
-
SHA1
46ddb3fa250dfb4808c3a43f7846d7c643a4f325
-
SHA256
2664162d0341d8e5cf1cf3a290b77406d87111e3c9ff3fcf3a4f0836d15d3afe
-
SHA512
485074c33256cd04b80f1f58297f5d26f55be56cd8837d35a825d8612407b310bfa29cde9e1934eec92da0a77b37f6e21f0ced9e3ce731ed8673c4b4da82f00e
Malware Config
Extracted
formbook
http://www.runwithit.media/bu43/
bearrootstherapy.com
odmpay.com
johnfornmgov.com
astrodhaam.com
pumavps.com
empireconstructiontx.com
theboujeestop.com
indictthem.com
plantationbarnof1810.com
nsxs.xyz
lgshowroom.com
allinlifestyle.club
ik-com.net
saitamacity-sports.com
neuromuscularmassagetherapy.com
freespiritnutrition.com
alexanderhamilton.computer
happysay.co.uk
nndesignpr.com
lightweightmouldings.com
sparkassen-oekosystem.finance
majestikflix.com
xbox360vpn.com
rivareservadapraca.com
waldherr.one
soluzionigare.com
personalizedsportsz.com
mycapecrusade.com
escrapedia.com
defineliberal.net
xn--54qt7bmzf8pw82mnmogwd.com
cookies-x.info
38buu.com
nirv.tech
isabellelodo.com
myquickmedia.com
luxuryevim.net
kimmycakesmore.com
akasyaofistasima.com
markhatesfreedom.com
stock-ology.com
opel-occasions-ales.com
lunajurado.com
musmarservices.com
editionsfeuvert.com
mizusukenikko.com
coaching-dreams.com
bentleyandraesdecorandmore.com
mr-mrsramirez.com
junarmusic.com
jesed72.com
serviceelectriccablevision1.com
e-capakistan.com
thedentalplanner.com
mohasaffron.com
tciclinics.info
rockinrranchpuntademita.com
gubbelspaprika.com
citizenspride.com
compprogedu.com
prierejanaza.com
toyotamotor360.com
academiadosaberdagrios.com
burakcelikkapi.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1440-1087-0x0000000000400000-0x0000000000429000-memory.dmp formbook behavioral1/memory/1440-1088-0x000000000041D0B0-mapping.dmp formbook behavioral1/memory/1068-1091-0x0000000000000000-mapping.dmp formbook -
Blacklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 6 2000 EQNEDT32.EXE -
Executes dropped EXE 2 IoCs
Processes:
skypound83892.exeskypound83892.exepid process 1124 skypound83892.exe 1440 skypound83892.exe -
Loads dropped DLL 1 IoCs
Processes:
EQNEDT32.EXEpid process 2000 EQNEDT32.EXE -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
skypound83892.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\firefos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Firefoxe\\firefos.exe\"" skypound83892.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
skypound83892.exeskypound83892.exesystray.exedescription pid process target process PID 1124 set thread context of 1440 1124 skypound83892.exe skypound83892.exe PID 1440 set thread context of 1248 1440 skypound83892.exe Explorer.EXE PID 1440 set thread context of 1248 1440 skypound83892.exe Explorer.EXE PID 1068 set thread context of 1248 1068 systray.exe Explorer.EXE -
Drops file in Windows directory 1 IoCs
Processes:
WINWORD.EXEdescription ioc process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
WINWORD.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 1700 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 25 IoCs
Processes:
skypound83892.exesystray.exepid process 1440 skypound83892.exe 1440 skypound83892.exe 1440 skypound83892.exe 1068 systray.exe 1068 systray.exe 1068 systray.exe 1068 systray.exe 1068 systray.exe 1068 systray.exe 1068 systray.exe 1068 systray.exe 1068 systray.exe 1068 systray.exe 1068 systray.exe 1068 systray.exe 1068 systray.exe 1068 systray.exe 1068 systray.exe 1068 systray.exe 1068 systray.exe 1068 systray.exe 1068 systray.exe 1068 systray.exe 1068 systray.exe 1068 systray.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
skypound83892.exesystray.exepid process 1440 skypound83892.exe 1440 skypound83892.exe 1440 skypound83892.exe 1440 skypound83892.exe 1068 systray.exe 1068 systray.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
skypound83892.exeskypound83892.exesystray.exedescription pid process Token: SeDebugPrivilege 1124 skypound83892.exe Token: SeDebugPrivilege 1440 skypound83892.exe Token: SeDebugPrivilege 1068 systray.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
WINWORD.EXEpid process 1700 WINWORD.EXE 1700 WINWORD.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
EQNEDT32.EXEskypound83892.exeskypound83892.exesystray.exedescription pid process target process PID 2000 wrote to memory of 1124 2000 EQNEDT32.EXE skypound83892.exe PID 2000 wrote to memory of 1124 2000 EQNEDT32.EXE skypound83892.exe PID 2000 wrote to memory of 1124 2000 EQNEDT32.EXE skypound83892.exe PID 2000 wrote to memory of 1124 2000 EQNEDT32.EXE skypound83892.exe PID 1124 wrote to memory of 1440 1124 skypound83892.exe skypound83892.exe PID 1124 wrote to memory of 1440 1124 skypound83892.exe skypound83892.exe PID 1124 wrote to memory of 1440 1124 skypound83892.exe skypound83892.exe PID 1124 wrote to memory of 1440 1124 skypound83892.exe skypound83892.exe PID 1124 wrote to memory of 1440 1124 skypound83892.exe skypound83892.exe PID 1124 wrote to memory of 1440 1124 skypound83892.exe skypound83892.exe PID 1124 wrote to memory of 1440 1124 skypound83892.exe skypound83892.exe PID 1440 wrote to memory of 1068 1440 skypound83892.exe systray.exe PID 1440 wrote to memory of 1068 1440 skypound83892.exe systray.exe PID 1440 wrote to memory of 1068 1440 skypound83892.exe systray.exe PID 1440 wrote to memory of 1068 1440 skypound83892.exe systray.exe PID 1068 wrote to memory of 2036 1068 systray.exe cmd.exe PID 1068 wrote to memory of 2036 1068 systray.exe cmd.exe PID 1068 wrote to memory of 2036 1068 systray.exe cmd.exe PID 1068 wrote to memory of 2036 1068 systray.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\VOMAXTRADING.doc"2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blacklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\skypound83892.exe"C:\Users\Admin\AppData\Roaming\skypound83892.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\skypound83892.exe"C:\Users\Admin\AppData\Roaming\skypound83892.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Roaming\skypound83892.exe"5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\skypound83892.exeMD5
ef8fc92d8b47c1f40dd5233aa9b3f260
SHA1ebbe29ad9cbeee24ae52a5a77f57d3c0add317d9
SHA2560757426a4b616e13f2ec816793e22cb933978a99bfc1a771537e68d74ad2d0d0
SHA512ed155470ce9fc32a16e2cfed9ac712f5c2eb8ad810bc6bf7c8916ffd3842d133a8b2dc8565c7373c92af4fbed536c953a65b2019d387eb06db9f1d5bfd504169
-
C:\Users\Admin\AppData\Roaming\skypound83892.exeMD5
ef8fc92d8b47c1f40dd5233aa9b3f260
SHA1ebbe29ad9cbeee24ae52a5a77f57d3c0add317d9
SHA2560757426a4b616e13f2ec816793e22cb933978a99bfc1a771537e68d74ad2d0d0
SHA512ed155470ce9fc32a16e2cfed9ac712f5c2eb8ad810bc6bf7c8916ffd3842d133a8b2dc8565c7373c92af4fbed536c953a65b2019d387eb06db9f1d5bfd504169
-
C:\Users\Admin\AppData\Roaming\skypound83892.exeMD5
ef8fc92d8b47c1f40dd5233aa9b3f260
SHA1ebbe29ad9cbeee24ae52a5a77f57d3c0add317d9
SHA2560757426a4b616e13f2ec816793e22cb933978a99bfc1a771537e68d74ad2d0d0
SHA512ed155470ce9fc32a16e2cfed9ac712f5c2eb8ad810bc6bf7c8916ffd3842d133a8b2dc8565c7373c92af4fbed536c953a65b2019d387eb06db9f1d5bfd504169
-
\Users\Admin\AppData\Roaming\skypound83892.exeMD5
ef8fc92d8b47c1f40dd5233aa9b3f260
SHA1ebbe29ad9cbeee24ae52a5a77f57d3c0add317d9
SHA2560757426a4b616e13f2ec816793e22cb933978a99bfc1a771537e68d74ad2d0d0
SHA512ed155470ce9fc32a16e2cfed9ac712f5c2eb8ad810bc6bf7c8916ffd3842d133a8b2dc8565c7373c92af4fbed536c953a65b2019d387eb06db9f1d5bfd504169
-
memory/880-1-0x000007FEF7D90000-0x000007FEF800A000-memory.dmpFilesize
2.5MB
-
memory/1068-1091-0x0000000000000000-mapping.dmp
-
memory/1068-1094-0x0000000004110000-0x000000000427E000-memory.dmpFilesize
1.4MB
-
memory/1068-1092-0x0000000000180000-0x0000000000185000-memory.dmpFilesize
20KB
-
memory/1124-3-0x0000000000000000-mapping.dmp
-
memory/1124-6-0x000000006BA70000-0x000000006C15E000-memory.dmpFilesize
6.9MB
-
memory/1124-7-0x00000000008F0000-0x00000000008F1000-memory.dmpFilesize
4KB
-
memory/1124-9-0x00000000046A0000-0x00000000046FB000-memory.dmpFilesize
364KB
-
memory/1124-1086-0x0000000022360000-0x0000000022376000-memory.dmpFilesize
88KB
-
memory/1248-1090-0x0000000006C50000-0x0000000006D65000-memory.dmpFilesize
1.1MB
-
memory/1248-1095-0x0000000003CB0000-0x0000000003D5D000-memory.dmpFilesize
692KB
-
memory/1440-1088-0x000000000041D0B0-mapping.dmp
-
memory/1440-1087-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1700-0-0x0000000003F10000-0x0000000003F14000-memory.dmpFilesize
16KB
-
memory/2036-1093-0x0000000000000000-mapping.dmp