Analysis
-
max time kernel
147s -
max time network
139s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
07-05-2021 00:16
Static task
static1
Behavioral task
behavioral1
Sample
payment copy.xlsx
Resource
win7v20210410
Behavioral task
behavioral2
Sample
payment copy.xlsx
Resource
win10v20210410
General
-
Target
payment copy.xlsx
-
Size
670KB
-
MD5
aea58eb70601d6c06d73b14c047d2274
-
SHA1
38a71f5ec2abe59a8fab0d13a46ac2a86ef0e2bf
-
SHA256
d4e1391a4c091eb93ee714ad3b7cb38363d1859c156a9c70d34f2176eb17af37
-
SHA512
8d36fc594ce7622b34764cf39612265b687a3ee1d2d644f6aebcaf215379aa5820a52f3df37c899d9663cc8a843689b1e148854b96707fae69dfb9f23910a6fa
Malware Config
Extracted
formbook
4.1
http://www.conciergedoctx.com/ot8m/
digiclan.net
songlautramtuoii.online
miracleseedproducts.com
taniacastillo.com
essentialme.network
charmcitydetour.com
suprekopis.com
jimmycollier.com
thrifteee.com
rhmachinery.ltd
the05project.com
altfacebookalt.com
ein-herz-fuer-holz.com
kingohost.com
vmarines.com
2bestudio.com
triducdv.com
kp-transport.com
mybostonhwart.com
benzcat.net
ajichouf24.com
aisoucheng.com
momagourmet.com
jj3977.com
modacimiz.com
akatsuki2017.com
mcallensolarpanels.com
totalsolarpanels.com
hamrahanedalat.com
littleavacadosco.com
personalloanspotterguides.info
pegasusdir.net
thetft.com
viscosetowels.com
erins.pizza
softlizer.com
ethicalcandleco.com
newactinc.express
premiumenterprisegroup.com
cwchsauce.com
emikosstore.com
milansclosetdoor.com
mpzazmrserv194.xyz
yelltee.com
cannabisclaim.com
jillsings.com
20bet9.com
byrondramos.com
rakovar.com
cqxyhpb.com
mycms.cloud
tutormenu.com
road35filez.com
restorationbydesign.net
leileinet.com
jumtix.xyz
devashrigreenssociety.com
sensationalwonderwomen.com
genesistc.net
rewibes.com
rockalingu.com
vipoboi.com
stewriley.com
yumleys.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/296-74-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/296-75-0x000000000041EC80-mapping.dmp formbook behavioral1/memory/1220-84-0x00000000000C0000-0x00000000000EE000-memory.dmp formbook -
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 7 1164 EQNEDT32.EXE -
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
shakix532232.exeshakix532232.exeshakix532232.exepid process 960 shakix532232.exe 1736 shakix532232.exe 296 shakix532232.exe -
Loads dropped DLL 1 IoCs
Processes:
EQNEDT32.EXEpid process 1164 EQNEDT32.EXE -
Suspicious use of SetThreadContext 3 IoCs
Processes:
shakix532232.exeshakix532232.exeNETSTAT.EXEdescription pid process target process PID 960 set thread context of 296 960 shakix532232.exe shakix532232.exe PID 296 set thread context of 1264 296 shakix532232.exe Explorer.EXE PID 1220 set thread context of 1264 1220 NETSTAT.EXE Explorer.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
NETSTAT.EXEpid process 1220 NETSTAT.EXE -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1088 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 25 IoCs
Processes:
shakix532232.exeshakix532232.exeNETSTAT.EXEpid process 960 shakix532232.exe 960 shakix532232.exe 960 shakix532232.exe 960 shakix532232.exe 296 shakix532232.exe 296 shakix532232.exe 1220 NETSTAT.EXE 1220 NETSTAT.EXE 1220 NETSTAT.EXE 1220 NETSTAT.EXE 1220 NETSTAT.EXE 1220 NETSTAT.EXE 1220 NETSTAT.EXE 1220 NETSTAT.EXE 1220 NETSTAT.EXE 1220 NETSTAT.EXE 1220 NETSTAT.EXE 1220 NETSTAT.EXE 1220 NETSTAT.EXE 1220 NETSTAT.EXE 1220 NETSTAT.EXE 1220 NETSTAT.EXE 1220 NETSTAT.EXE 1220 NETSTAT.EXE 1220 NETSTAT.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
shakix532232.exeNETSTAT.EXEpid process 296 shakix532232.exe 296 shakix532232.exe 296 shakix532232.exe 1220 NETSTAT.EXE 1220 NETSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
shakix532232.exeshakix532232.exeNETSTAT.EXEExplorer.EXEdescription pid process Token: SeDebugPrivilege 960 shakix532232.exe Token: SeDebugPrivilege 296 shakix532232.exe Token: SeDebugPrivilege 1220 NETSTAT.EXE Token: SeShutdownPrivilege 1264 Explorer.EXE Token: SeShutdownPrivilege 1264 Explorer.EXE -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1088 EXCEL.EXE 1088 EXCEL.EXE 1088 EXCEL.EXE -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
EQNEDT32.EXEshakix532232.exeExplorer.EXENETSTAT.EXEdescription pid process target process PID 1164 wrote to memory of 960 1164 EQNEDT32.EXE shakix532232.exe PID 1164 wrote to memory of 960 1164 EQNEDT32.EXE shakix532232.exe PID 1164 wrote to memory of 960 1164 EQNEDT32.EXE shakix532232.exe PID 1164 wrote to memory of 960 1164 EQNEDT32.EXE shakix532232.exe PID 960 wrote to memory of 1736 960 shakix532232.exe shakix532232.exe PID 960 wrote to memory of 1736 960 shakix532232.exe shakix532232.exe PID 960 wrote to memory of 1736 960 shakix532232.exe shakix532232.exe PID 960 wrote to memory of 1736 960 shakix532232.exe shakix532232.exe PID 960 wrote to memory of 296 960 shakix532232.exe shakix532232.exe PID 960 wrote to memory of 296 960 shakix532232.exe shakix532232.exe PID 960 wrote to memory of 296 960 shakix532232.exe shakix532232.exe PID 960 wrote to memory of 296 960 shakix532232.exe shakix532232.exe PID 960 wrote to memory of 296 960 shakix532232.exe shakix532232.exe PID 960 wrote to memory of 296 960 shakix532232.exe shakix532232.exe PID 960 wrote to memory of 296 960 shakix532232.exe shakix532232.exe PID 1264 wrote to memory of 1220 1264 Explorer.EXE NETSTAT.EXE PID 1264 wrote to memory of 1220 1264 Explorer.EXE NETSTAT.EXE PID 1264 wrote to memory of 1220 1264 Explorer.EXE NETSTAT.EXE PID 1264 wrote to memory of 1220 1264 Explorer.EXE NETSTAT.EXE PID 1220 wrote to memory of 1056 1220 NETSTAT.EXE cmd.exe PID 1220 wrote to memory of 1056 1220 NETSTAT.EXE cmd.exe PID 1220 wrote to memory of 1056 1220 NETSTAT.EXE cmd.exe PID 1220 wrote to memory of 1056 1220 NETSTAT.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\payment copy.xlsx"2⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Roaming\shakix532232.exe"3⤵
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\shakix532232.exe"C:\Users\Admin\AppData\Roaming\shakix532232.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\shakix532232.exe"{path}"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\shakix532232.exe"{path}"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\shakix532232.exeMD5
52289e533348a695d881c6df2d895f5e
SHA12cc712357a0d94f590eb126f2697373d9cca4ea1
SHA2567653e46e3326fbabf9e534cbd02600f87ad38b5c9e4e175a60e27a6d90c5e6fe
SHA512f456b1d29ed931fdc067973b76e586fd942baa0a26218c76cb2ea72a557e6fbaceba005846b366d3b3a998771e16e5b22147fcf4295a369da2240fe22a2d1b98
-
C:\Users\Admin\AppData\Roaming\shakix532232.exeMD5
52289e533348a695d881c6df2d895f5e
SHA12cc712357a0d94f590eb126f2697373d9cca4ea1
SHA2567653e46e3326fbabf9e534cbd02600f87ad38b5c9e4e175a60e27a6d90c5e6fe
SHA512f456b1d29ed931fdc067973b76e586fd942baa0a26218c76cb2ea72a557e6fbaceba005846b366d3b3a998771e16e5b22147fcf4295a369da2240fe22a2d1b98
-
C:\Users\Admin\AppData\Roaming\shakix532232.exeMD5
52289e533348a695d881c6df2d895f5e
SHA12cc712357a0d94f590eb126f2697373d9cca4ea1
SHA2567653e46e3326fbabf9e534cbd02600f87ad38b5c9e4e175a60e27a6d90c5e6fe
SHA512f456b1d29ed931fdc067973b76e586fd942baa0a26218c76cb2ea72a557e6fbaceba005846b366d3b3a998771e16e5b22147fcf4295a369da2240fe22a2d1b98
-
C:\Users\Admin\AppData\Roaming\shakix532232.exeMD5
52289e533348a695d881c6df2d895f5e
SHA12cc712357a0d94f590eb126f2697373d9cca4ea1
SHA2567653e46e3326fbabf9e534cbd02600f87ad38b5c9e4e175a60e27a6d90c5e6fe
SHA512f456b1d29ed931fdc067973b76e586fd942baa0a26218c76cb2ea72a557e6fbaceba005846b366d3b3a998771e16e5b22147fcf4295a369da2240fe22a2d1b98
-
\Users\Admin\AppData\Roaming\shakix532232.exeMD5
52289e533348a695d881c6df2d895f5e
SHA12cc712357a0d94f590eb126f2697373d9cca4ea1
SHA2567653e46e3326fbabf9e534cbd02600f87ad38b5c9e4e175a60e27a6d90c5e6fe
SHA512f456b1d29ed931fdc067973b76e586fd942baa0a26218c76cb2ea72a557e6fbaceba005846b366d3b3a998771e16e5b22147fcf4295a369da2240fe22a2d1b98
-
memory/296-78-0x00000000009C0000-0x0000000000CC3000-memory.dmpFilesize
3.0MB
-
memory/296-75-0x000000000041EC80-mapping.dmp
-
memory/296-79-0x00000000003C0000-0x00000000003D4000-memory.dmpFilesize
80KB
-
memory/296-74-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/960-64-0x0000000000000000-mapping.dmp
-
memory/960-67-0x00000000001A0000-0x00000000001A1000-memory.dmpFilesize
4KB
-
memory/960-69-0x0000000004B70000-0x0000000004B71000-memory.dmpFilesize
4KB
-
memory/960-70-0x0000000000410000-0x000000000041E000-memory.dmpFilesize
56KB
-
memory/960-71-0x0000000005170000-0x00000000051FF000-memory.dmpFilesize
572KB
-
memory/960-72-0x0000000000570000-0x00000000005B4000-memory.dmpFilesize
272KB
-
memory/1056-82-0x0000000000000000-mapping.dmp
-
memory/1088-60-0x00000000713F1000-0x00000000713F3000-memory.dmpFilesize
8KB
-
memory/1088-61-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1088-59-0x000000002F7A1000-0x000000002F7A4000-memory.dmpFilesize
12KB
-
memory/1164-62-0x00000000753B1000-0x00000000753B3000-memory.dmpFilesize
8KB
-
memory/1220-81-0x0000000000000000-mapping.dmp
-
memory/1220-83-0x0000000000390000-0x0000000000399000-memory.dmpFilesize
36KB
-
memory/1220-84-0x00000000000C0000-0x00000000000EE000-memory.dmpFilesize
184KB
-
memory/1220-85-0x00000000020E0000-0x00000000023E3000-memory.dmpFilesize
3.0MB
-
memory/1220-86-0x0000000001F50000-0x0000000001FE3000-memory.dmpFilesize
588KB
-
memory/1264-80-0x0000000006EE0000-0x000000000704F000-memory.dmpFilesize
1.4MB
-
memory/1264-87-0x0000000004A50000-0x0000000004B02000-memory.dmpFilesize
712KB