Analysis
-
max time kernel
147s -
max time network
9s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
14-01-2021 06:27
Static task
static1
Behavioral task
behavioral1
Sample
New -PO January.xlsx
Resource
win7v20201028
Behavioral task
behavioral2
Sample
New -PO January.xlsx
Resource
win10v20201028
General
-
Target
New -PO January.xlsx
-
Size
2.0MB
-
MD5
23bbc2d2c1f6938d9f701bd185ae52b8
-
SHA1
d90da454ef1ba74843356d00190b5232cf848b4f
-
SHA256
1d4245f324118521fb7eb936379da4a25cb5101d5634f21376fa196663efdc35
-
SHA512
5809706d71109adeee4f08980197b1dd7ced0f2dd584eff24a922749139241fc7b04323dfc54552e79cff4e75e77e554d15acbce3c14d96e69510acf17101311
Malware Config
Extracted
formbook
http://www.thesiromiel.com/kgw/
valentinakasu.com
soyelmatador.com
collaborativeprosperity.com
power8brokers.com
nexus-ink.com
manpasandmeatmarket.com
the-ethical-forums.today
maryannpark.com
bikininbodymommy.com
pxwuo.com
bigbangmerch.com
okaysinger.com
shopcarpe.com
rainbowhillsswimclub.com
crifinmarket.com
ebl-play.net
forceandsonsequipment.com
viagraytqwi.com
latashashop.com
suffocatinglymundanepodcast.com
metanoria.com
camera-kento.com
hotsaledeals.store
outlawgospelshow.com
saisaharashipping.com
buyiprod.com
pestigenix.com
opendesignpodcast.com
patentml.com
covaxbiotech.com
youjar.com
domvy.xyz
remodelmemphis.com
milehighdistributionllc.com
merchandisingpremium.com
fallguysmovile.com
actuelburo.xyz
nedlebow.com
shopcryptocurrency247.com
riellymoore.com
affinitymotorsales.com
akmh.pro
hsrrxs.com
atlanticdentallab.com
sagarpantry.com
murinemodel.com
karybeautycare.com
boshangkeji.com
dailynewstodays.com
oregonpyramids.com
dsjmzyz.com
gidagozlemevi.com
tribelessofficial.com
cyberonica.com
onehourcheckout.com
tenaflypedatrics.com
nbworldfire.com
setyourhead.com
manticore-habitat.com
iqftomatoes.com
fejsearesete.com
gregsgradeaappliancerepair.com
sfmfgco.com
directprnews.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1708-16-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1708-17-0x000000000041EB70-mapping.dmp formbook behavioral1/memory/756-19-0x0000000000000000-mapping.dmp formbook -
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 6 1896 EQNEDT32.EXE -
Executes dropped EXE 3 IoCs
Processes:
vbc.exevbc.exevbc.exepid process 1536 vbc.exe 1480 vbc.exe 1708 vbc.exe -
Looks for VMWare Tools registry key 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
vbc.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion vbc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion vbc.exe -
Loads dropped DLL 4 IoCs
Processes:
EQNEDT32.EXEpid process 1896 EQNEDT32.EXE 1896 EQNEDT32.EXE 1896 EQNEDT32.EXE 1896 EQNEDT32.EXE -
Uses the VBS compiler for execution 1 TTPs
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
vbc.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum vbc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 vbc.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
vbc.exevbc.exehelp.exedescription pid process target process PID 1536 set thread context of 1708 1536 vbc.exe vbc.exe PID 1708 set thread context of 1260 1708 vbc.exe Explorer.EXE PID 1708 set thread context of 1260 1708 vbc.exe Explorer.EXE PID 756 set thread context of 1260 756 help.exe Explorer.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
EXCEL.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1936 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
vbc.exevbc.exehelp.exepid process 1536 vbc.exe 1536 vbc.exe 1708 vbc.exe 1708 vbc.exe 1708 vbc.exe 756 help.exe 756 help.exe 756 help.exe 756 help.exe 756 help.exe 756 help.exe 756 help.exe 756 help.exe 756 help.exe 756 help.exe 756 help.exe 756 help.exe 756 help.exe 756 help.exe 756 help.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
vbc.exehelp.exepid process 1708 vbc.exe 1708 vbc.exe 1708 vbc.exe 1708 vbc.exe 756 help.exe 756 help.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vbc.exevbc.exehelp.exedescription pid process Token: SeDebugPrivilege 1536 vbc.exe Token: SeDebugPrivilege 1708 vbc.exe Token: SeDebugPrivilege 756 help.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1936 EXCEL.EXE 1936 EXCEL.EXE 1936 EXCEL.EXE -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
EQNEDT32.EXEvbc.exeExplorer.EXEhelp.exedescription pid process target process PID 1896 wrote to memory of 1536 1896 EQNEDT32.EXE vbc.exe PID 1896 wrote to memory of 1536 1896 EQNEDT32.EXE vbc.exe PID 1896 wrote to memory of 1536 1896 EQNEDT32.EXE vbc.exe PID 1896 wrote to memory of 1536 1896 EQNEDT32.EXE vbc.exe PID 1536 wrote to memory of 1480 1536 vbc.exe vbc.exe PID 1536 wrote to memory of 1480 1536 vbc.exe vbc.exe PID 1536 wrote to memory of 1480 1536 vbc.exe vbc.exe PID 1536 wrote to memory of 1480 1536 vbc.exe vbc.exe PID 1536 wrote to memory of 1708 1536 vbc.exe vbc.exe PID 1536 wrote to memory of 1708 1536 vbc.exe vbc.exe PID 1536 wrote to memory of 1708 1536 vbc.exe vbc.exe PID 1536 wrote to memory of 1708 1536 vbc.exe vbc.exe PID 1536 wrote to memory of 1708 1536 vbc.exe vbc.exe PID 1536 wrote to memory of 1708 1536 vbc.exe vbc.exe PID 1536 wrote to memory of 1708 1536 vbc.exe vbc.exe PID 1260 wrote to memory of 756 1260 Explorer.EXE help.exe PID 1260 wrote to memory of 756 1260 Explorer.EXE help.exe PID 1260 wrote to memory of 756 1260 Explorer.EXE help.exe PID 1260 wrote to memory of 756 1260 Explorer.EXE help.exe PID 756 wrote to memory of 368 756 help.exe cmd.exe PID 756 wrote to memory of 368 756 help.exe cmd.exe PID 756 wrote to memory of 368 756 help.exe cmd.exe PID 756 wrote to memory of 368 756 help.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\New -PO January.xlsx"2⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Public\vbc.exe"3⤵
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"3⤵
- Executes dropped EXE
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\vbc.exeMD5
deed11e2b4b23dbe0c9ef99b5390bd6f
SHA1158662003b5e63c1419267d5e8b0d4ce79e72081
SHA256326090842ee6d692e02ae131a2003658939f60e79bceb7bad983cfe16400062f
SHA512380a473f9e6ce25e5e68ac15794d1bcbe125a887067a48c258abb625b96080d90fad32cb860043af4b32d4d8afc84365726e4a861ec03976a6bec7651d3e0380
-
C:\Users\Public\vbc.exeMD5
deed11e2b4b23dbe0c9ef99b5390bd6f
SHA1158662003b5e63c1419267d5e8b0d4ce79e72081
SHA256326090842ee6d692e02ae131a2003658939f60e79bceb7bad983cfe16400062f
SHA512380a473f9e6ce25e5e68ac15794d1bcbe125a887067a48c258abb625b96080d90fad32cb860043af4b32d4d8afc84365726e4a861ec03976a6bec7651d3e0380
-
C:\Users\Public\vbc.exeMD5
deed11e2b4b23dbe0c9ef99b5390bd6f
SHA1158662003b5e63c1419267d5e8b0d4ce79e72081
SHA256326090842ee6d692e02ae131a2003658939f60e79bceb7bad983cfe16400062f
SHA512380a473f9e6ce25e5e68ac15794d1bcbe125a887067a48c258abb625b96080d90fad32cb860043af4b32d4d8afc84365726e4a861ec03976a6bec7651d3e0380
-
C:\Users\Public\vbc.exeMD5
deed11e2b4b23dbe0c9ef99b5390bd6f
SHA1158662003b5e63c1419267d5e8b0d4ce79e72081
SHA256326090842ee6d692e02ae131a2003658939f60e79bceb7bad983cfe16400062f
SHA512380a473f9e6ce25e5e68ac15794d1bcbe125a887067a48c258abb625b96080d90fad32cb860043af4b32d4d8afc84365726e4a861ec03976a6bec7651d3e0380
-
\Users\Public\vbc.exeMD5
deed11e2b4b23dbe0c9ef99b5390bd6f
SHA1158662003b5e63c1419267d5e8b0d4ce79e72081
SHA256326090842ee6d692e02ae131a2003658939f60e79bceb7bad983cfe16400062f
SHA512380a473f9e6ce25e5e68ac15794d1bcbe125a887067a48c258abb625b96080d90fad32cb860043af4b32d4d8afc84365726e4a861ec03976a6bec7651d3e0380
-
\Users\Public\vbc.exeMD5
deed11e2b4b23dbe0c9ef99b5390bd6f
SHA1158662003b5e63c1419267d5e8b0d4ce79e72081
SHA256326090842ee6d692e02ae131a2003658939f60e79bceb7bad983cfe16400062f
SHA512380a473f9e6ce25e5e68ac15794d1bcbe125a887067a48c258abb625b96080d90fad32cb860043af4b32d4d8afc84365726e4a861ec03976a6bec7651d3e0380
-
\Users\Public\vbc.exeMD5
deed11e2b4b23dbe0c9ef99b5390bd6f
SHA1158662003b5e63c1419267d5e8b0d4ce79e72081
SHA256326090842ee6d692e02ae131a2003658939f60e79bceb7bad983cfe16400062f
SHA512380a473f9e6ce25e5e68ac15794d1bcbe125a887067a48c258abb625b96080d90fad32cb860043af4b32d4d8afc84365726e4a861ec03976a6bec7651d3e0380
-
\Users\Public\vbc.exeMD5
deed11e2b4b23dbe0c9ef99b5390bd6f
SHA1158662003b5e63c1419267d5e8b0d4ce79e72081
SHA256326090842ee6d692e02ae131a2003658939f60e79bceb7bad983cfe16400062f
SHA512380a473f9e6ce25e5e68ac15794d1bcbe125a887067a48c258abb625b96080d90fad32cb860043af4b32d4d8afc84365726e4a861ec03976a6bec7651d3e0380
-
memory/368-21-0x0000000000000000-mapping.dmp
-
memory/752-2-0x000007FEF6E90000-0x000007FEF710A000-memory.dmpFilesize
2.5MB
-
memory/756-22-0x00000000007D0000-0x000000000094E000-memory.dmpFilesize
1.5MB
-
memory/756-20-0x0000000000220000-0x0000000000226000-memory.dmpFilesize
24KB
-
memory/756-19-0x0000000000000000-mapping.dmp
-
memory/1536-13-0x0000000000820000-0x0000000000832000-memory.dmpFilesize
72KB
-
memory/1536-14-0x00000000050D0000-0x000000000513F000-memory.dmpFilesize
444KB
-
memory/1536-11-0x0000000000020000-0x0000000000021000-memory.dmpFilesize
4KB
-
memory/1536-10-0x000000006B630000-0x000000006BD1E000-memory.dmpFilesize
6.9MB
-
memory/1536-7-0x0000000000000000-mapping.dmp
-
memory/1708-16-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1708-17-0x000000000041EB70-mapping.dmp