Analysis
-
max time kernel
148s -
max time network
145s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
19-01-2021 06:03
Static task
static1
Behavioral task
behavioral1
Sample
SHEXD210117S_ShippingDocument_DkD.xlsx
Resource
win7v20201028
Behavioral task
behavioral2
Sample
SHEXD210117S_ShippingDocument_DkD.xlsx
Resource
win10v20201028
General
-
Target
SHEXD210117S_ShippingDocument_DkD.xlsx
-
Size
2.3MB
-
MD5
bae7476565583cc0aa5a3947495b7626
-
SHA1
239ad3d5064b678d48ec18d3fae04110e7ef17e9
-
SHA256
cbc3c8432b8722c7c4504e93ad97e9dcea7d7df9e018893e981cf7e5ebbc8eb4
-
SHA512
c98274e684b3948d282b63f0ad8e83a8b86a2926da6b4865a1a6cd38005a428632fb34059eba7f096186220e0c1368a8d758c4af173e3510ab56590606071b02
Malware Config
Extracted
formbook
http://www.stonescapes1.com/de92/
zindaginews.com
tyelevator.com
schustermaninterests.com
algemixdelchef.com
doubscollectivites.com
e-butchery.com
hellbentmask.com
jumbpprivacy.com
teeniestiedye.com
playfulartwork.com
desertvacahs.com
w5470-hed.net
nepalearningpods.com
smoothandsleek.com
thecannaglow.com
torrentkittyla.com
industrytoyou.com
raquelvargas.net
rlc-nc.net
cryptoprises.com
chinjungmom.com
blondedevil.com
associationindependence.com
tokachiashi50.xyz
cantstoptennis.com
english3s.com
flowtechblasting.com
customputtputtgolf.com
onointeriors.com
lenafive.com
jygraphics.com
plantologia.com
withatwist2016.com
bingent.info
nakedsumac.com
rosetheamazingrealtor.com
gogoivyschool.com
silhouettebodyspa.com
fomssdf4.com
goodcontractor.net
republicpc.com
zante2020.com
t-junko.com
kittens.finance
mkchemicalvina.com
quadacross.com
maemaetravelworld.com
bradforrexchange.com
fashiongomaufacturer.com
hollapac.com
qxmenye.com
neuro-robotics.com
365shared.com
dinamisapp.com
b3service.com
getyourquan.com
udothat.com
cutting21778.com
vdacouture.com
venerossala.com
thefunboxshoppe.com
indomedianewsc.com
nagansatu.com
precisionoxes.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2000-28-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral1/memory/2000-29-0x000000000041D010-mapping.dmp xloader behavioral1/memory/940-38-0x00000000000D0000-0x00000000000F8000-memory.dmp xloader -
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 7 1412 EQNEDT32.EXE -
Executes dropped EXE 2 IoCs
Processes:
vbc.exevbc.exepid process 932 vbc.exe 2000 vbc.exe -
Loads dropped DLL 4 IoCs
Processes:
EQNEDT32.EXEpid process 1412 EQNEDT32.EXE 1412 EQNEDT32.EXE 1412 EQNEDT32.EXE 1412 EQNEDT32.EXE -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
vbc.exevbc.exesystray.exedescription pid process target process PID 932 set thread context of 2000 932 vbc.exe vbc.exe PID 2000 set thread context of 1200 2000 vbc.exe Explorer.EXE PID 940 set thread context of 1200 940 systray.exe Explorer.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
EXCEL.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1812 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
vbc.exevbc.exesystray.exepid process 932 vbc.exe 932 vbc.exe 2000 vbc.exe 2000 vbc.exe 940 systray.exe 940 systray.exe 940 systray.exe 940 systray.exe 940 systray.exe 940 systray.exe 940 systray.exe 940 systray.exe 940 systray.exe 940 systray.exe 940 systray.exe 940 systray.exe 940 systray.exe 940 systray.exe 940 systray.exe 940 systray.exe 940 systray.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
vbc.exesystray.exepid process 2000 vbc.exe 2000 vbc.exe 2000 vbc.exe 940 systray.exe 940 systray.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vbc.exevbc.exesystray.exedescription pid process Token: SeDebugPrivilege 932 vbc.exe Token: SeDebugPrivilege 2000 vbc.exe Token: SeDebugPrivilege 940 systray.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1812 EXCEL.EXE 1812 EXCEL.EXE 1812 EXCEL.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
EQNEDT32.EXEvbc.exeExplorer.EXEsystray.exedescription pid process target process PID 1412 wrote to memory of 932 1412 EQNEDT32.EXE vbc.exe PID 1412 wrote to memory of 932 1412 EQNEDT32.EXE vbc.exe PID 1412 wrote to memory of 932 1412 EQNEDT32.EXE vbc.exe PID 1412 wrote to memory of 932 1412 EQNEDT32.EXE vbc.exe PID 932 wrote to memory of 2000 932 vbc.exe vbc.exe PID 932 wrote to memory of 2000 932 vbc.exe vbc.exe PID 932 wrote to memory of 2000 932 vbc.exe vbc.exe PID 932 wrote to memory of 2000 932 vbc.exe vbc.exe PID 932 wrote to memory of 2000 932 vbc.exe vbc.exe PID 932 wrote to memory of 2000 932 vbc.exe vbc.exe PID 932 wrote to memory of 2000 932 vbc.exe vbc.exe PID 1200 wrote to memory of 940 1200 Explorer.EXE systray.exe PID 1200 wrote to memory of 940 1200 Explorer.EXE systray.exe PID 1200 wrote to memory of 940 1200 Explorer.EXE systray.exe PID 1200 wrote to memory of 940 1200 Explorer.EXE systray.exe PID 940 wrote to memory of 1060 940 systray.exe cmd.exe PID 940 wrote to memory of 1060 940 systray.exe cmd.exe PID 940 wrote to memory of 1060 940 systray.exe cmd.exe PID 940 wrote to memory of 1060 940 systray.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\SHEXD210117S_ShippingDocument_DkD.xlsx2⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Public\vbc.exe"3⤵
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\vbc.exe"{path}"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\vbc.exeMD5
08554cb035e1c8f14b980019ffae237c
SHA12d64711f6503c3b6ffd792aa0119efffae61883d
SHA256a243e6a605d8bb403f4cacb90a290d8f415d523dcc3c6eeedcf72f5cf803efa4
SHA512540d02b2748201c115ef4d763d78167bc3d659fd75f927e7750c5aee8a7d6c268f7b80ff6c5d7df49555c5f3c9175760275f337b8bbeba558d83b9586f93a094
-
C:\Users\Public\vbc.exeMD5
08554cb035e1c8f14b980019ffae237c
SHA12d64711f6503c3b6ffd792aa0119efffae61883d
SHA256a243e6a605d8bb403f4cacb90a290d8f415d523dcc3c6eeedcf72f5cf803efa4
SHA512540d02b2748201c115ef4d763d78167bc3d659fd75f927e7750c5aee8a7d6c268f7b80ff6c5d7df49555c5f3c9175760275f337b8bbeba558d83b9586f93a094
-
C:\Users\Public\vbc.exeMD5
08554cb035e1c8f14b980019ffae237c
SHA12d64711f6503c3b6ffd792aa0119efffae61883d
SHA256a243e6a605d8bb403f4cacb90a290d8f415d523dcc3c6eeedcf72f5cf803efa4
SHA512540d02b2748201c115ef4d763d78167bc3d659fd75f927e7750c5aee8a7d6c268f7b80ff6c5d7df49555c5f3c9175760275f337b8bbeba558d83b9586f93a094
-
\Users\Public\vbc.exeMD5
08554cb035e1c8f14b980019ffae237c
SHA12d64711f6503c3b6ffd792aa0119efffae61883d
SHA256a243e6a605d8bb403f4cacb90a290d8f415d523dcc3c6eeedcf72f5cf803efa4
SHA512540d02b2748201c115ef4d763d78167bc3d659fd75f927e7750c5aee8a7d6c268f7b80ff6c5d7df49555c5f3c9175760275f337b8bbeba558d83b9586f93a094
-
\Users\Public\vbc.exeMD5
08554cb035e1c8f14b980019ffae237c
SHA12d64711f6503c3b6ffd792aa0119efffae61883d
SHA256a243e6a605d8bb403f4cacb90a290d8f415d523dcc3c6eeedcf72f5cf803efa4
SHA512540d02b2748201c115ef4d763d78167bc3d659fd75f927e7750c5aee8a7d6c268f7b80ff6c5d7df49555c5f3c9175760275f337b8bbeba558d83b9586f93a094
-
\Users\Public\vbc.exeMD5
08554cb035e1c8f14b980019ffae237c
SHA12d64711f6503c3b6ffd792aa0119efffae61883d
SHA256a243e6a605d8bb403f4cacb90a290d8f415d523dcc3c6eeedcf72f5cf803efa4
SHA512540d02b2748201c115ef4d763d78167bc3d659fd75f927e7750c5aee8a7d6c268f7b80ff6c5d7df49555c5f3c9175760275f337b8bbeba558d83b9586f93a094
-
\Users\Public\vbc.exeMD5
08554cb035e1c8f14b980019ffae237c
SHA12d64711f6503c3b6ffd792aa0119efffae61883d
SHA256a243e6a605d8bb403f4cacb90a290d8f415d523dcc3c6eeedcf72f5cf803efa4
SHA512540d02b2748201c115ef4d763d78167bc3d659fd75f927e7750c5aee8a7d6c268f7b80ff6c5d7df49555c5f3c9175760275f337b8bbeba558d83b9586f93a094
-
memory/516-6-0x000007FEF79D0000-0x000007FEF7C4A000-memory.dmpFilesize
2.5MB
-
memory/932-19-0x0000000000500000-0x0000000000511000-memory.dmpFilesize
68KB
-
memory/932-18-0x0000000004AA0000-0x0000000004AA1000-memory.dmpFilesize
4KB
-
memory/932-11-0x0000000000000000-mapping.dmp
-
memory/932-27-0x0000000004E40000-0x0000000004E95000-memory.dmpFilesize
340KB
-
memory/932-14-0x000000006C3A0000-0x000000006CA8E000-memory.dmpFilesize
6.9MB
-
memory/932-15-0x0000000000B00000-0x0000000000B01000-memory.dmpFilesize
4KB
-
memory/932-17-0x0000000002070000-0x00000000020E6000-memory.dmpFilesize
472KB
-
memory/932-26-0x0000000000580000-0x000000000058E000-memory.dmpFilesize
56KB
-
memory/932-24-0x0000000000500000-0x0000000000511000-memory.dmpFilesize
68KB
-
memory/940-37-0x00000000007A0000-0x00000000007A5000-memory.dmpFilesize
20KB
-
memory/940-35-0x0000000000000000-mapping.dmp
-
memory/940-41-0x0000000000560000-0x00000000005EF000-memory.dmpFilesize
572KB
-
memory/940-39-0x0000000002060000-0x0000000002363000-memory.dmpFilesize
3.0MB
-
memory/940-38-0x00000000000D0000-0x00000000000F8000-memory.dmpFilesize
160KB
-
memory/1060-36-0x0000000000000000-mapping.dmp
-
memory/1200-34-0x0000000006F20000-0x00000000070B9000-memory.dmpFilesize
1.6MB
-
memory/1200-42-0x00000000066D0000-0x00000000067DF000-memory.dmpFilesize
1.1MB
-
memory/1412-5-0x0000000076241000-0x0000000076243000-memory.dmpFilesize
8KB
-
memory/1812-3-0x0000000071241000-0x0000000071243000-memory.dmpFilesize
8KB
-
memory/1812-2-0x000000002F521000-0x000000002F524000-memory.dmpFilesize
12KB
-
memory/1812-4-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/2000-32-0x0000000000C70000-0x0000000000F73000-memory.dmpFilesize
3.0MB
-
memory/2000-33-0x0000000000270000-0x0000000000280000-memory.dmpFilesize
64KB
-
memory/2000-29-0x000000000041D010-mapping.dmp
-
memory/2000-28-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB