594b6fc5ffe9608371a2853db4a54d89d5bef4294680bfd835fa05b20f575b17

General

Target

PO VASE.xlsx
Size

1.3MB
MD5

08bfe97addcfdc8ea68d56a80a16621a
SHA1

2111b3ffb8b32bad9d341848bdab6688e280a222
SHA256

594b6fc5ffe9608371a2853db4a54d89d5bef4294680bfd835fa05b20f575b17
SHA512

f17cc20e7884ef6b1d446feeb35f65129ec4cfd3a86208c7b639d9b3d1ac36d51b92c5aa9ed31d20f20ea61b895aa071ed8755752581620e110087f36171cd91

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

EQNEDT32.EXE

flow pid process

5 1724 EQNEDT32.EXE
Downloads MZ/PE file
Executes dropped EXE 1 IoCs

Processes:

vbc.exe

pid process

1152 vbc.exe
Loads dropped DLL 2 IoCs

Processes:

EQNEDT32.EXE

pid process

1724 EQNEDT32.EXE
1724 EQNEDT32.EXE
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

EXCEL.EXE

description ioc process

Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
exploit

Exploitation for Client Execution
T1203

Processes:

EQNEDT32.EXE

pid process

1724 EQNEDT32.EXE

flow	pid	process
5	1724	EQNEDT32.EXE

pid	process
1152	vbc.exe

pid	process
1724	EQNEDT32.EXE
1724	EQNEDT32.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

pid	process
1724	EQNEDT32.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

EXCEL.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1996 EXCEL.EXE
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

vbc.exe

pid process

1152 vbc.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

EXCEL.EXE

pid process

1996 EXCEL.EXE
1996 EXCEL.EXE
1996 EXCEL.EXE

pid	process
1996	EXCEL.EXE

pid	process
1152	vbc.exe

pid	process
1996	EXCEL.EXE
1996	EXCEL.EXE
1996	EXCEL.EXE

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

EQNEDT32.EXEvbc.exe

description	pid	process	target process
PID 1724 wrote to memory of 1152	1724	EQNEDT32.EXE	vbc.exe
PID 1724 wrote to memory of 1152	1724	EQNEDT32.EXE	vbc.exe
PID 1724 wrote to memory of 1152	1724	EQNEDT32.EXE	vbc.exe
PID 1724 wrote to memory of 1152	1724	EQNEDT32.EXE	vbc.exe
PID 1152 wrote to memory of 1120	1152	vbc.exe	MSBuild.exe
PID 1152 wrote to memory of 1120	1152	vbc.exe	MSBuild.exe
PID 1152 wrote to memory of 1120	1152	vbc.exe	MSBuild.exe
PID 1152 wrote to memory of 1120	1152	vbc.exe	MSBuild.exe
PID 1152 wrote to memory of 1120	1152	vbc.exe	MSBuild.exe

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\PO VASE.xlsx"
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1996

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:1724

C:\Users\Public\vbc.exe
"C:\Users\Public\vbc.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1152

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Users\Public\vbc.exe"
3⤵
PID:1120

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Exploitation for Client Execution

Scripting

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Scripting

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\vbc.exe
MD5
29e9ad8d44e49d2a2fa76ab14d6881cc

SHA1
bdc37994f00f36ce6c20261f395a25cb6f142267

SHA256
8bf2c9097f211f15879c233eacd3c5b6e767d768c5941765d986ab61ba877341

SHA512
3efc9b48804a7d978fd00385c5adf4135f3f699507ac6e3621e9eaf3cdbe75973c34f67778baca5ab31d3133ca782ba0b44c222bcba5b2249361901d4e18cbb6

Download Submit
C:\Users\Public\vbc.exe
MD5
29e9ad8d44e49d2a2fa76ab14d6881cc

SHA1
bdc37994f00f36ce6c20261f395a25cb6f142267

SHA256
8bf2c9097f211f15879c233eacd3c5b6e767d768c5941765d986ab61ba877341

SHA512
3efc9b48804a7d978fd00385c5adf4135f3f699507ac6e3621e9eaf3cdbe75973c34f67778baca5ab31d3133ca782ba0b44c222bcba5b2249361901d4e18cbb6

Download Submit
\Users\Public\vbc.exe
MD5
29e9ad8d44e49d2a2fa76ab14d6881cc

SHA1
bdc37994f00f36ce6c20261f395a25cb6f142267

SHA256
8bf2c9097f211f15879c233eacd3c5b6e767d768c5941765d986ab61ba877341

SHA512
3efc9b48804a7d978fd00385c5adf4135f3f699507ac6e3621e9eaf3cdbe75973c34f67778baca5ab31d3133ca782ba0b44c222bcba5b2249361901d4e18cbb6

Download Submit
\Users\Public\vbc.exe
MD5
29e9ad8d44e49d2a2fa76ab14d6881cc

SHA1
bdc37994f00f36ce6c20261f395a25cb6f142267

SHA256
8bf2c9097f211f15879c233eacd3c5b6e767d768c5941765d986ab61ba877341

SHA512
3efc9b48804a7d978fd00385c5adf4135f3f699507ac6e3621e9eaf3cdbe75973c34f67778baca5ab31d3133ca782ba0b44c222bcba5b2249361901d4e18cbb6

Download Submit
memory/1152-68-0x00000000001B0000-0x00000000001B2000-memory.dmp

Filesize
8KB

Download
memory/1152-65-0x0000000000000000-mapping.dmp

Download
memory/1724-62-0x0000000075D41000-0x0000000075D43000-memory.dmp

Filesize
8KB

Download
memory/1996-61-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1996-59-0x000000002F841000-0x000000002F844000-memory.dmp

Filesize
12KB

Download
memory/1996-60-0x0000000070F91000-0x0000000070F93000-memory.dmp

Filesize
8KB

Download
memory/1996-70-0x0000000005F02000-0x0000000005F04000-memory.dmp

Filesize
8KB

Download
memory/1996-71-0x0000000005F04000-0x0000000005F06000-memory.dmp

Filesize
8KB

Download
memory/1996-69-0x0000000005F00000-0x0000000005F02000-memory.dmp

Filesize
8KB

Download
memory/1996-72-0x0000000005F06000-0x0000000005F09000-memory.dmp

Filesize
12KB

Download
memory/1996-73-0x0000000005F09000-0x0000000005F0A000-memory.dmp

Filesize
4KB

Download
memory/1996-74-0x0000000005F0A000-0x0000000005F0C000-memory.dmp

Filesize
8KB

Download
memory/1996-75-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing