Analysis
-
max time kernel
149s -
max time network
140s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
15-01-2021 15:38
Static task
static1
Behavioral task
behavioral1
Sample
Alfa Laval Aalborg AS Statement of Account.xlsx
Resource
win7v20201028
Behavioral task
behavioral2
Sample
Alfa Laval Aalborg AS Statement of Account.xlsx
Resource
win10v20201028
General
-
Target
Alfa Laval Aalborg AS Statement of Account.xlsx
-
Size
1.7MB
-
MD5
8a26ff06c494c96457f847edb7ca80c0
-
SHA1
a165479dde0175896cd0d70bb68616688bb7d328
-
SHA256
255389c8a0f1e5da9cd479450c1e80210c14a3e36fb47f0898f24aabc8a962db
-
SHA512
186686e95d7255b5d37b646eb1a2a7de07f2888c77a65cab4724c127d28cedd1e3fdac77af4cd74f8affecd10f637ab94844a7d27cb4528341ce0f0d8f5e597a
Malware Config
Extracted
formbook
http://www.bytecommunication.com/aky/
jeiksaoeklea.com
sagame-auto.net
soloseriolavoro.com
thecreatorsbook.com
superskritch.com
oroxequipment.com
heart-of-art.online
liwedfg.com
fisherofsouls.com
jota.xyz
nehyam.com
smart-contact-delivery.com
hoom.guru
dgryds.com
thesoakcpd.com
mishv.com
rings-factory.info
bero-craft-beers.com
podcastnamegenerators.com
856379813.xyz
ruinfectious.com
wdcsupport.com
youngbrokeandeducated.com
shpments75.com
louisbmartinez100th.com
shining.ink
hkexpresswaterford.com
quickcashoffersatl.com
180cliniconline.com
mainriskintl.com
clinicadosorriso.com
kuxueyunkeji.com
smart-acumen.com
maisonkerlann.com
jewishposter.com
xn--w52b77ujva.com
antoniodevivo.com
diversitypatriots.com
tiotacos.company
ventumgi.com
ip-tv.online
smithvilletexashistory.com
amruta-varshini.com
wildpositive.com
alifezap.com
nczjt.net
palmsvillaswhitneyranch.com
experiencemoretogether.com
dewitfire.com
scruffynotfluffy.online
bazarsurtidorico.com
dayscosmetics.com
tpsvegas.com
externalboard.com
2125lynchmere.com
agroplenty.com
easterneuropemall.com
whtoys888.com
writehousepoint.com
ppeaceandgloves.com
sadtire.press
jj3994.com
smokenengines.com
offplanprojects-re.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/788-15-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/788-16-0x000000000041EB60-mapping.dmp formbook behavioral1/memory/2000-18-0x0000000000000000-mapping.dmp formbook -
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 7 1384 EQNEDT32.EXE -
Executes dropped EXE 2 IoCs
Processes:
vbc.exevbc.exepid process 1940 vbc.exe 788 vbc.exe -
Loads dropped DLL 4 IoCs
Processes:
EQNEDT32.EXEpid process 1384 EQNEDT32.EXE 1384 EQNEDT32.EXE 1384 EQNEDT32.EXE 1384 EQNEDT32.EXE -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 4 IoCs
Processes:
vbc.exevbc.exewscript.exedescription pid process target process PID 1940 set thread context of 788 1940 vbc.exe vbc.exe PID 788 set thread context of 1256 788 vbc.exe Explorer.EXE PID 788 set thread context of 1256 788 vbc.exe Explorer.EXE PID 2000 set thread context of 1256 2000 wscript.exe Explorer.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
EXCEL.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1080 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
vbc.exewscript.exepid process 788 vbc.exe 788 vbc.exe 788 vbc.exe 2000 wscript.exe 2000 wscript.exe 2000 wscript.exe 2000 wscript.exe 2000 wscript.exe 2000 wscript.exe 2000 wscript.exe 2000 wscript.exe 2000 wscript.exe 2000 wscript.exe 2000 wscript.exe 2000 wscript.exe 2000 wscript.exe 2000 wscript.exe 2000 wscript.exe 2000 wscript.exe 2000 wscript.exe 2000 wscript.exe 2000 wscript.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
vbc.exewscript.exepid process 788 vbc.exe 788 vbc.exe 788 vbc.exe 788 vbc.exe 2000 wscript.exe 2000 wscript.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
vbc.exewscript.exedescription pid process Token: SeDebugPrivilege 788 vbc.exe Token: SeDebugPrivilege 2000 wscript.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1080 EXCEL.EXE 1080 EXCEL.EXE 1080 EXCEL.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
EQNEDT32.EXEvbc.exeExplorer.EXEwscript.exedescription pid process target process PID 1384 wrote to memory of 1940 1384 EQNEDT32.EXE vbc.exe PID 1384 wrote to memory of 1940 1384 EQNEDT32.EXE vbc.exe PID 1384 wrote to memory of 1940 1384 EQNEDT32.EXE vbc.exe PID 1384 wrote to memory of 1940 1384 EQNEDT32.EXE vbc.exe PID 1940 wrote to memory of 788 1940 vbc.exe vbc.exe PID 1940 wrote to memory of 788 1940 vbc.exe vbc.exe PID 1940 wrote to memory of 788 1940 vbc.exe vbc.exe PID 1940 wrote to memory of 788 1940 vbc.exe vbc.exe PID 1940 wrote to memory of 788 1940 vbc.exe vbc.exe PID 1940 wrote to memory of 788 1940 vbc.exe vbc.exe PID 1940 wrote to memory of 788 1940 vbc.exe vbc.exe PID 1256 wrote to memory of 2000 1256 Explorer.EXE wscript.exe PID 1256 wrote to memory of 2000 1256 Explorer.EXE wscript.exe PID 1256 wrote to memory of 2000 1256 Explorer.EXE wscript.exe PID 1256 wrote to memory of 2000 1256 Explorer.EXE wscript.exe PID 2000 wrote to memory of 396 2000 wscript.exe cmd.exe PID 2000 wrote to memory of 396 2000 wscript.exe cmd.exe PID 2000 wrote to memory of 396 2000 wscript.exe cmd.exe PID 2000 wrote to memory of 396 2000 wscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\Alfa Laval Aalborg AS Statement of Account.xlsx"2⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Public\vbc.exe"3⤵
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\vbc.exe"{path}"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\vbc.exeMD5
c343b0f63b6c4dc9d3f5dd7864f6edd6
SHA1d28b97bb29685705b0b38f3d955a0ddb33b414dc
SHA256c58e2d245f99b53a5d4006c4f1daac8085b622eeab9958a576e7b82ae8e8380d
SHA512e3737d85c8ecb2ceb47ee6dc6505f38f4a4b467780fabf0bb179f35175264b1b4114fd9e368af186b774500cc9d67fc5919c1b90d6c0f377a7a2b3de09d69c52
-
C:\Users\Public\vbc.exeMD5
c343b0f63b6c4dc9d3f5dd7864f6edd6
SHA1d28b97bb29685705b0b38f3d955a0ddb33b414dc
SHA256c58e2d245f99b53a5d4006c4f1daac8085b622eeab9958a576e7b82ae8e8380d
SHA512e3737d85c8ecb2ceb47ee6dc6505f38f4a4b467780fabf0bb179f35175264b1b4114fd9e368af186b774500cc9d67fc5919c1b90d6c0f377a7a2b3de09d69c52
-
C:\Users\Public\vbc.exeMD5
c343b0f63b6c4dc9d3f5dd7864f6edd6
SHA1d28b97bb29685705b0b38f3d955a0ddb33b414dc
SHA256c58e2d245f99b53a5d4006c4f1daac8085b622eeab9958a576e7b82ae8e8380d
SHA512e3737d85c8ecb2ceb47ee6dc6505f38f4a4b467780fabf0bb179f35175264b1b4114fd9e368af186b774500cc9d67fc5919c1b90d6c0f377a7a2b3de09d69c52
-
\Users\Public\vbc.exeMD5
c343b0f63b6c4dc9d3f5dd7864f6edd6
SHA1d28b97bb29685705b0b38f3d955a0ddb33b414dc
SHA256c58e2d245f99b53a5d4006c4f1daac8085b622eeab9958a576e7b82ae8e8380d
SHA512e3737d85c8ecb2ceb47ee6dc6505f38f4a4b467780fabf0bb179f35175264b1b4114fd9e368af186b774500cc9d67fc5919c1b90d6c0f377a7a2b3de09d69c52
-
\Users\Public\vbc.exeMD5
c343b0f63b6c4dc9d3f5dd7864f6edd6
SHA1d28b97bb29685705b0b38f3d955a0ddb33b414dc
SHA256c58e2d245f99b53a5d4006c4f1daac8085b622eeab9958a576e7b82ae8e8380d
SHA512e3737d85c8ecb2ceb47ee6dc6505f38f4a4b467780fabf0bb179f35175264b1b4114fd9e368af186b774500cc9d67fc5919c1b90d6c0f377a7a2b3de09d69c52
-
\Users\Public\vbc.exeMD5
c343b0f63b6c4dc9d3f5dd7864f6edd6
SHA1d28b97bb29685705b0b38f3d955a0ddb33b414dc
SHA256c58e2d245f99b53a5d4006c4f1daac8085b622eeab9958a576e7b82ae8e8380d
SHA512e3737d85c8ecb2ceb47ee6dc6505f38f4a4b467780fabf0bb179f35175264b1b4114fd9e368af186b774500cc9d67fc5919c1b90d6c0f377a7a2b3de09d69c52
-
\Users\Public\vbc.exeMD5
c343b0f63b6c4dc9d3f5dd7864f6edd6
SHA1d28b97bb29685705b0b38f3d955a0ddb33b414dc
SHA256c58e2d245f99b53a5d4006c4f1daac8085b622eeab9958a576e7b82ae8e8380d
SHA512e3737d85c8ecb2ceb47ee6dc6505f38f4a4b467780fabf0bb179f35175264b1b4114fd9e368af186b774500cc9d67fc5919c1b90d6c0f377a7a2b3de09d69c52
-
memory/396-20-0x0000000000000000-mapping.dmp
-
memory/788-15-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/788-16-0x000000000041EB60-mapping.dmp
-
memory/1740-2-0x000007FEF6930000-0x000007FEF6BAA000-memory.dmpFilesize
2.5MB
-
memory/1940-11-0x0000000000CF0000-0x0000000000CF1000-memory.dmpFilesize
4KB
-
memory/1940-13-0x0000000000460000-0x000000000046E000-memory.dmpFilesize
56KB
-
memory/1940-14-0x0000000004860000-0x00000000048AB000-memory.dmpFilesize
300KB
-
memory/1940-10-0x000000006CC80000-0x000000006D36E000-memory.dmpFilesize
6.9MB
-
memory/1940-7-0x0000000000000000-mapping.dmp
-
memory/2000-18-0x0000000000000000-mapping.dmp
-
memory/2000-19-0x0000000000960000-0x0000000000986000-memory.dmpFilesize
152KB
-
memory/2000-21-0x0000000003140000-0x0000000003288000-memory.dmpFilesize
1.3MB