Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
08-04-2021 06:08
Static task
static1
Behavioral task
behavioral1
Sample
Quotation Zhejiang.xlsx
Resource
win7v20201028
Behavioral task
behavioral2
Sample
Quotation Zhejiang.xlsx
Resource
win10v20201028
General
-
Target
Quotation Zhejiang.xlsx
-
Size
2.5MB
-
MD5
a783de23277908ff94909e76e010e774
-
SHA1
1439eb6b441bbe2723cb05829011a9fd415caafb
-
SHA256
0d5ed941ed1f15a168cdd5be0abc6b9a0806ae42c267f7eb5ca35f5697fdf346
-
SHA512
7d31e27c69bad458c21bd8775970645c0b257b2e8e0e592b1b40bd79725544d98643ae96d51a4322dcc88f749522d245ac9821238b8421c63a3a7715ef7bac85
Malware Config
Extracted
xloader
2.3
http://www.stone-master.info/aqu2/
thesixteenthround.net
nagoyadoori.xyz
bipv.company
imaginus-posters.com
heliumhubs.com
baohood.com
thesahwfam.com
susanlevinedesign.com
pdxcontracttracer.com
shopathamiltons.com
qcmax.com
didongthongminh.store
igotbacon.com
5915599.com
seacrestonsietakey.com
bumiflowers.com
arcax.info
lfhis.com
mlqconsultores.com
duilian2013.com
pmrack.com
zayo.today
latiina.space
fitandfierceathletics.com
printerpartsuk.com
xn--2021-kmd.com
shujahumayun.com
younitygroup.com
serinelab.com
infinapisoft.com
administrativoinform.photos
all4mortuary.com
annaschenck.xyz
christlicheliebe.net
starr2021.com
familierafting-aktiviteter.com
thunderoffroadresort.com
mex33.info
serversexposed.com
chronicbodypaintherapy.com
billionaireblinggg.com
permanentmarkertattoo.com
albestfab.com
biehnrecords.com
yesonmeasurec.vote
bootstrapexpress.com
howtopreventwaterpollution.com
fatlosszone4u.com
hostvngiare.com
dottproject.com
appgusher.com
playfulpainters.com
gab.expert
18598853855.com
bizcebozca.com
bedpee.com
militaryhistorytv.com
teluguc.net
420vaca.com
ritarkomondal.com
autobrehna.com
happlyending.com
arcticblastairheat.com
urbanladder.info
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1556-19-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1716-28-0x0000000000080000-0x00000000000A9000-memory.dmp xloader -
Blocklisted process makes network request 3 IoCs
Processes:
EQNEDT32.EXEflow pid process 6 1996 EQNEDT32.EXE 8 1996 EQNEDT32.EXE 10 1996 EQNEDT32.EXE -
Executes dropped EXE 2 IoCs
Processes:
vbc.exevbc.exepid process 1532 vbc.exe 1556 vbc.exe -
Loads dropped DLL 4 IoCs
Processes:
EQNEDT32.EXEvbc.exepid process 1996 EQNEDT32.EXE 1996 EQNEDT32.EXE 1996 EQNEDT32.EXE 1532 vbc.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 4 IoCs
Processes:
vbc.exevbc.exechkdsk.exedescription pid process target process PID 1532 set thread context of 1556 1532 vbc.exe vbc.exe PID 1556 set thread context of 1248 1556 vbc.exe Explorer.EXE PID 1556 set thread context of 1248 1556 vbc.exe Explorer.EXE PID 1716 set thread context of 1248 1716 chkdsk.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NSIS installer 6 IoCs
Processes:
resource yara_rule \Users\Public\vbc.exe nsis_installer_1 \Users\Public\vbc.exe nsis_installer_1 \Users\Public\vbc.exe nsis_installer_1 C:\Users\Public\vbc.exe nsis_installer_1 C:\Users\Public\vbc.exe nsis_installer_1 C:\Users\Public\vbc.exe nsis_installer_1 -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
chkdsk.exeEXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE -
Modifies registry class 64 IoCs
Processes:
EXCEL.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLCheckbox" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}\ = "LabelControlEvents" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}\ = "MdcToggleButtonEvents" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcCheckBox" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{47FF8FE2-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents3" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}\ = "IScrollbar" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLReset" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3}\ = "MdcListEvents" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{4C599243-6926-101B-9992-00000B65C6F9} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}\ = "IMultiPage" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{82B02370-B5BC-11CF-810F-00A0C9030074}\ = "IReturnInteger" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcText" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}\ = "ICommandButton" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{47FF8FE9-6198-11CF-8CE8-00AA006CB389} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{47FF8FE8-6198-11CF-8CE8-00AA006CB389} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\TypeLib\{57752A35-A1B6-47DE-B562-91D1F625EBF2}\2.0\FLAGS\ = "6" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLText" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}\ = "MdcOptionButtonEvents" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080}\ = "Tab" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776}\ = "ISpinbutton" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}\ = "TabStripEvents" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents6" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\TypeLib\{57752A35-A1B6-47DE-B562-91D1F625EBF2}\2.0\FLAGS EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{944ACF93-A1E6-11CE-8104-00AA00611080}\ = "Tabs" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}\ = "MdcTextEvents" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF} EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{57752A35-A1B6-47DE-B562-91D1F625EBF2}\2.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Excel8.0" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}\ = "ICommandButton" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}\ = "IScrollbar" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}\ = "MdcOptionButtonEvents" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074}\ = "IReturnBoolean" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776} EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{57752A35-A1B6-47DE-B562-91D1F625EBF2}\2.0\FLAGS\ = "6" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69}\ = "IDataAutoWrapper" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{8BD21D42-EC42-11CE-9E0D-00AA006002F3} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{47FF8FE4-6198-11CF-8CE8-00AA006CB389} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074}\ = "IReturnString" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLSubmitButton" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F}\ = "MultiPageEvents" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}\ = "ControlEvents" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLOption" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{57752A35-A1B6-47DE-B562-91D1F625EBF2}\2.0\ = "Microsoft Forms 2.0 Object Library" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}\ = "MdcCheckBoxEvents" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000_CLASSES\Wow6432Node\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}\ = "FormEvents" EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1724 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 29 IoCs
Processes:
vbc.exechkdsk.exepid process 1556 vbc.exe 1556 vbc.exe 1556 vbc.exe 1716 chkdsk.exe 1716 chkdsk.exe 1716 chkdsk.exe 1716 chkdsk.exe 1716 chkdsk.exe 1716 chkdsk.exe 1716 chkdsk.exe 1716 chkdsk.exe 1716 chkdsk.exe 1716 chkdsk.exe 1716 chkdsk.exe 1716 chkdsk.exe 1716 chkdsk.exe 1716 chkdsk.exe 1716 chkdsk.exe 1716 chkdsk.exe 1716 chkdsk.exe 1716 chkdsk.exe 1716 chkdsk.exe 1716 chkdsk.exe 1716 chkdsk.exe 1716 chkdsk.exe 1716 chkdsk.exe 1716 chkdsk.exe 1716 chkdsk.exe 1716 chkdsk.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
vbc.exevbc.exechkdsk.exepid process 1532 vbc.exe 1556 vbc.exe 1556 vbc.exe 1556 vbc.exe 1556 vbc.exe 1716 chkdsk.exe 1716 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
vbc.exeExplorer.EXEchkdsk.exedescription pid process Token: SeDebugPrivilege 1556 vbc.exe Token: SeShutdownPrivilege 1248 Explorer.EXE Token: SeShutdownPrivilege 1248 Explorer.EXE Token: SeDebugPrivilege 1716 chkdsk.exe Token: SeShutdownPrivilege 1248 Explorer.EXE Token: SeShutdownPrivilege 1248 Explorer.EXE Token: SeShutdownPrivilege 1248 Explorer.EXE Token: SeShutdownPrivilege 1248 Explorer.EXE -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1724 EXCEL.EXE 1724 EXCEL.EXE 1724 EXCEL.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
EQNEDT32.EXEvbc.exeExplorer.EXEchkdsk.exedescription pid process target process PID 1996 wrote to memory of 1532 1996 EQNEDT32.EXE vbc.exe PID 1996 wrote to memory of 1532 1996 EQNEDT32.EXE vbc.exe PID 1996 wrote to memory of 1532 1996 EQNEDT32.EXE vbc.exe PID 1996 wrote to memory of 1532 1996 EQNEDT32.EXE vbc.exe PID 1532 wrote to memory of 1556 1532 vbc.exe vbc.exe PID 1532 wrote to memory of 1556 1532 vbc.exe vbc.exe PID 1532 wrote to memory of 1556 1532 vbc.exe vbc.exe PID 1532 wrote to memory of 1556 1532 vbc.exe vbc.exe PID 1532 wrote to memory of 1556 1532 vbc.exe vbc.exe PID 1248 wrote to memory of 1716 1248 Explorer.EXE chkdsk.exe PID 1248 wrote to memory of 1716 1248 Explorer.EXE chkdsk.exe PID 1248 wrote to memory of 1716 1248 Explorer.EXE chkdsk.exe PID 1248 wrote to memory of 1716 1248 Explorer.EXE chkdsk.exe PID 1716 wrote to memory of 1272 1716 chkdsk.exe cmd.exe PID 1716 wrote to memory of 1272 1716 chkdsk.exe cmd.exe PID 1716 wrote to memory of 1272 1716 chkdsk.exe cmd.exe PID 1716 wrote to memory of 1272 1716 chkdsk.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\Quotation Zhejiang.xlsx"2⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Public\vbc.exe"3⤵
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\vbc.exeMD5
2c64897aa30694cc768f5ea375157932
SHA1c897f37780a5237d5c330bcf2668745201b38ff5
SHA25618d465a5867ee069480bb9be8eb259be41cc008e487b7b6a3cad14e3559963a9
SHA5126c1cfc20e4aaf0ee78b60a80c5ff559cb71ac31b62f2e9068638046cd3fec5fe078f37de85c50c65090b82d784931e07bdf692a597b14133eae36ad143b3fea2
-
C:\Users\Public\vbc.exeMD5
2c64897aa30694cc768f5ea375157932
SHA1c897f37780a5237d5c330bcf2668745201b38ff5
SHA25618d465a5867ee069480bb9be8eb259be41cc008e487b7b6a3cad14e3559963a9
SHA5126c1cfc20e4aaf0ee78b60a80c5ff559cb71ac31b62f2e9068638046cd3fec5fe078f37de85c50c65090b82d784931e07bdf692a597b14133eae36ad143b3fea2
-
C:\Users\Public\vbc.exeMD5
2c64897aa30694cc768f5ea375157932
SHA1c897f37780a5237d5c330bcf2668745201b38ff5
SHA25618d465a5867ee069480bb9be8eb259be41cc008e487b7b6a3cad14e3559963a9
SHA5126c1cfc20e4aaf0ee78b60a80c5ff559cb71ac31b62f2e9068638046cd3fec5fe078f37de85c50c65090b82d784931e07bdf692a597b14133eae36ad143b3fea2
-
\Users\Admin\AppData\Local\Temp\nsc4BEF.tmp\e4utfxiuc.dllMD5
7023c422b5d2571d6b132378437b1e9e
SHA11f2c41b1e36dda6ed420b5f8708af6457f59a10d
SHA2562bf1f784b019210a10eef61e5af8abfbb9e02748cf9d6718f4bf6b3f72661779
SHA5122659574ede5079f0b522c01e0fd7fcdd4ded74d895650126979980221ba77582c01defa76dddda42bc73e4c5cc8268d4285da29d6c438212503b6ed1529c596d
-
\Users\Public\vbc.exeMD5
2c64897aa30694cc768f5ea375157932
SHA1c897f37780a5237d5c330bcf2668745201b38ff5
SHA25618d465a5867ee069480bb9be8eb259be41cc008e487b7b6a3cad14e3559963a9
SHA5126c1cfc20e4aaf0ee78b60a80c5ff559cb71ac31b62f2e9068638046cd3fec5fe078f37de85c50c65090b82d784931e07bdf692a597b14133eae36ad143b3fea2
-
\Users\Public\vbc.exeMD5
2c64897aa30694cc768f5ea375157932
SHA1c897f37780a5237d5c330bcf2668745201b38ff5
SHA25618d465a5867ee069480bb9be8eb259be41cc008e487b7b6a3cad14e3559963a9
SHA5126c1cfc20e4aaf0ee78b60a80c5ff559cb71ac31b62f2e9068638046cd3fec5fe078f37de85c50c65090b82d784931e07bdf692a597b14133eae36ad143b3fea2
-
\Users\Public\vbc.exeMD5
2c64897aa30694cc768f5ea375157932
SHA1c897f37780a5237d5c330bcf2668745201b38ff5
SHA25618d465a5867ee069480bb9be8eb259be41cc008e487b7b6a3cad14e3559963a9
SHA5126c1cfc20e4aaf0ee78b60a80c5ff559cb71ac31b62f2e9068638046cd3fec5fe078f37de85c50c65090b82d784931e07bdf692a597b14133eae36ad143b3fea2
-
memory/1248-24-0x0000000006B80000-0x0000000006D26000-memory.dmpFilesize
1.6MB
-
memory/1248-22-0x00000000050E0000-0x00000000051D4000-memory.dmpFilesize
976KB
-
memory/1248-31-0x00000000068A0000-0x0000000006967000-memory.dmpFilesize
796KB
-
memory/1272-26-0x0000000000000000-mapping.dmp
-
memory/1532-16-0x00000000003F0000-0x00000000003F2000-memory.dmpFilesize
8KB
-
memory/1532-10-0x0000000000000000-mapping.dmp
-
memory/1556-23-0x00000000006D0000-0x00000000006E1000-memory.dmpFilesize
68KB
-
memory/1556-17-0x000000000041D090-mapping.dmp
-
memory/1556-19-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1556-21-0x00000000003E0000-0x00000000003F1000-memory.dmpFilesize
68KB
-
memory/1556-20-0x0000000000770000-0x0000000000A73000-memory.dmpFilesize
3.0MB
-
memory/1716-27-0x0000000000760000-0x0000000000767000-memory.dmpFilesize
28KB
-
memory/1716-30-0x0000000001E70000-0x0000000001F00000-memory.dmpFilesize
576KB
-
memory/1716-29-0x00000000020D0000-0x00000000023D3000-memory.dmpFilesize
3.0MB
-
memory/1716-28-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1716-25-0x0000000000000000-mapping.dmp
-
memory/1724-4-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1724-15-0x0000000005E80000-0x0000000005E82000-memory.dmpFilesize
8KB
-
memory/1724-3-0x0000000071C61000-0x0000000071C63000-memory.dmpFilesize
8KB
-
memory/1724-2-0x000000002F881000-0x000000002F884000-memory.dmpFilesize
12KB
-
memory/1884-6-0x000007FEF6AC0000-0x000007FEF6D3A000-memory.dmpFilesize
2.5MB
-
memory/1996-5-0x00000000761E1000-0x00000000761E3000-memory.dmpFilesize
8KB