2c5e3d15af1b6984f0462ccf500e7042f2db3996a979ce228e02fdd7016b14c2

General

Target

JUSTIFICANTE TRANSFERENCIA.xlsx
Size

2.0MB
MD5

db38643af9b77bf55db95fbeeb921452
SHA1

f5e2e36b20cf2f4c40dd27d8c68b0dbd09c3c505
SHA256

2c5e3d15af1b6984f0462ccf500e7042f2db3996a979ce228e02fdd7016b14c2
SHA512

0230b5154f72671944365340d212755abbbecb731db5f2e4e863f5bef06d5bcf5df43eacd3a5d4976d7ead79f1112cb1caa98e5f8fe454e06b70d45070140846

Score

8^/10

persistence

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

EQNEDT32.EXE

flow pid process

7 1668 EQNEDT32.EXE
Executes dropped EXE 3 IoCs

Processes:

vbc.exevbc.exevbc.exe

pid process

1204 vbc.exe
1572 vbc.exe
1700 vbc.exe
Loads dropped DLL 1 IoCs

Processes:

EQNEDT32.EXE

pid process

1668 EQNEDT32.EXE
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

flow	pid	process
7	1668	EQNEDT32.EXE

pid	process
1204	vbc.exe
1572	vbc.exe
1700	vbc.exe

pid	process
1668	EQNEDT32.EXE

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

vbc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\DbKrOz = "C:\\Users\\Admin\\AppData\\Roaming\\DbKrOz\\DbKrOz.exe"	vbc.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

vbc.exe

description pid process target process

PID 1204 set thread context of 1700 1204 vbc.exe vbc.exe
Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

EXCEL.EXE

description ioc process

Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
exploit

Exploitation for Client Execution
T1203

Processes:

EQNEDT32.EXE

pid process

1668 EQNEDT32.EXE

description	pid	process	target process
PID 1204 set thread context of 1700	1204	vbc.exe	vbc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

pid	process
1668	EQNEDT32.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

EXCEL.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1652 EXCEL.EXE
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

vbc.exevbc.exe

pid process

1204 vbc.exe
1204 vbc.exe
1700 vbc.exe
1700 vbc.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

vbc.exevbc.exe

description pid process

Token: SeDebugPrivilege 1204 vbc.exe
Token: SeDebugPrivilege 1700 vbc.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

EXCEL.EXE

pid process

1652 EXCEL.EXE
1652 EXCEL.EXE
1652 EXCEL.EXE

pid	process
1652	EXCEL.EXE

pid	process
1204	vbc.exe
1204	vbc.exe
1700	vbc.exe
1700	vbc.exe

description	pid	process
Token: SeDebugPrivilege	1204	vbc.exe
Token: SeDebugPrivilege	1700	vbc.exe

pid	process
1652	EXCEL.EXE
1652	EXCEL.EXE
1652	EXCEL.EXE

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

EQNEDT32.EXEvbc.exe

description	pid	process	target process
PID 1668 wrote to memory of 1204	1668	EQNEDT32.EXE	vbc.exe
PID 1668 wrote to memory of 1204	1668	EQNEDT32.EXE	vbc.exe
PID 1668 wrote to memory of 1204	1668	EQNEDT32.EXE	vbc.exe
PID 1668 wrote to memory of 1204	1668	EQNEDT32.EXE	vbc.exe
PID 1204 wrote to memory of 1572	1204	vbc.exe	vbc.exe
PID 1204 wrote to memory of 1572	1204	vbc.exe	vbc.exe
PID 1204 wrote to memory of 1572	1204	vbc.exe	vbc.exe
PID 1204 wrote to memory of 1572	1204	vbc.exe	vbc.exe
PID 1204 wrote to memory of 1700	1204	vbc.exe	vbc.exe
PID 1204 wrote to memory of 1700	1204	vbc.exe	vbc.exe
PID 1204 wrote to memory of 1700	1204	vbc.exe	vbc.exe
PID 1204 wrote to memory of 1700	1204	vbc.exe	vbc.exe
PID 1204 wrote to memory of 1700	1204	vbc.exe	vbc.exe
PID 1204 wrote to memory of 1700	1204	vbc.exe	vbc.exe
PID 1204 wrote to memory of 1700	1204	vbc.exe	vbc.exe
PID 1204 wrote to memory of 1700	1204	vbc.exe	vbc.exe
PID 1204 wrote to memory of 1700	1204	vbc.exe	vbc.exe

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE TRANSFERENCIA.xlsx"
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1652

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:1668

C:\Users\Public\vbc.exe
C:\Users\Public\vbc.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1204

C:\Users\Public\vbc.exe
"{path}"
3⤵
- Executes dropped EXE
PID:1572

C:\Users\Public\vbc.exe
"{path}"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1700

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Exploitation for Client Execution

1

T1203

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\vbc.exe
MD5
c450b6bba8ebd30823858735dcfa08d4

SHA1
be1270ad15f036e7461f6c15f975a945c387d3f5

SHA256
6cc5587ed0f3092e277208f5766a290e9b6eec39a31c3f0cb1892dd046fecdf3

SHA512
febfca0c2bf6d1f12659328e180866d55607f25345a82c15fcc38b265ac4f22d732f3ccd141c0d495c2470a9e4de8a0cff63401061e94c7f02283468b01b5294

Download Submit
C:\Users\Public\vbc.exe
MD5
c450b6bba8ebd30823858735dcfa08d4

SHA1
be1270ad15f036e7461f6c15f975a945c387d3f5

SHA256
6cc5587ed0f3092e277208f5766a290e9b6eec39a31c3f0cb1892dd046fecdf3

SHA512
febfca0c2bf6d1f12659328e180866d55607f25345a82c15fcc38b265ac4f22d732f3ccd141c0d495c2470a9e4de8a0cff63401061e94c7f02283468b01b5294

Download Submit
C:\Users\Public\vbc.exe
MD5
c450b6bba8ebd30823858735dcfa08d4

SHA1
be1270ad15f036e7461f6c15f975a945c387d3f5

SHA256
6cc5587ed0f3092e277208f5766a290e9b6eec39a31c3f0cb1892dd046fecdf3

SHA512
febfca0c2bf6d1f12659328e180866d55607f25345a82c15fcc38b265ac4f22d732f3ccd141c0d495c2470a9e4de8a0cff63401061e94c7f02283468b01b5294

Download Submit
C:\Users\Public\vbc.exe
MD5
c450b6bba8ebd30823858735dcfa08d4

SHA1
be1270ad15f036e7461f6c15f975a945c387d3f5

SHA256
6cc5587ed0f3092e277208f5766a290e9b6eec39a31c3f0cb1892dd046fecdf3

SHA512
febfca0c2bf6d1f12659328e180866d55607f25345a82c15fcc38b265ac4f22d732f3ccd141c0d495c2470a9e4de8a0cff63401061e94c7f02283468b01b5294

Download Submit
\Users\Public\vbc.exe
MD5
c450b6bba8ebd30823858735dcfa08d4

SHA1
be1270ad15f036e7461f6c15f975a945c387d3f5

SHA256
6cc5587ed0f3092e277208f5766a290e9b6eec39a31c3f0cb1892dd046fecdf3

SHA512
febfca0c2bf6d1f12659328e180866d55607f25345a82c15fcc38b265ac4f22d732f3ccd141c0d495c2470a9e4de8a0cff63401061e94c7f02283468b01b5294

Download Submit
memory/1204-12-0x0000000000DD0000-0x0000000000DD1000-memory.dmp

Filesize
4KB

Download
memory/1204-15-0x0000000000530000-0x000000000053E000-memory.dmp

Filesize
56KB

Download
memory/1204-16-0x0000000005260000-0x00000000052C3000-memory.dmp

Filesize
396KB

Download
memory/1204-8-0x0000000000000000-mapping.dmp

Download
memory/1204-11-0x000000006C3C0000-0x000000006CAAE000-memory.dmp

Filesize
6.9MB

Download
memory/1204-14-0x0000000004C90000-0x0000000004C91000-memory.dmp

Filesize
4KB

Download
memory/1324-6-0x000007FEF7800000-0x000007FEF7A7A000-memory.dmp

Filesize
2.5MB

Download
memory/1652-2-0x000000002F701000-0x000000002F704000-memory.dmp

Filesize
12KB

Download
memory/1652-4-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1652-3-0x00000000715B1000-0x00000000715B3000-memory.dmp

Filesize
8KB

Download
memory/1668-5-0x0000000075571000-0x0000000075573000-memory.dmp

Filesize
8KB

Download
memory/1700-18-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1700-19-0x00000000004374DE-mapping.dmp

Download
memory/1700-21-0x000000006C3C0000-0x000000006CAAE000-memory.dmp

Filesize
6.9MB

Download
memory/1700-22-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1700-24-0x0000000004A90000-0x0000000004A91000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads