qakbot | b420642be3fb8799c1700185d9a68a7de077fd798ef9ad024f728b5a031fd94c

Resubmissions

28-09-2021 20:53

210928-zpkf8sdbem 10

28-09-2021 15:35

210928-s1h9zscdbp 10

Analysis

max time kernel
603s
max time network
605s
platform
windows7_x64
resource
win7v20210408
submitted
28-09-2021 15:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CompensationClaim-68254946-09282021.xls
Size

137KB
MD5

e0574cf808d9b7150bac6b894baec9f0
SHA1

6603fa83dbb84f3a0d35982a37dbc5250699a64a
SHA256

7fddbdbd20255e29207d6765f7c3d19a235be7e55ca6184a76a74c2175da8bf4
SHA512

9f98689c83358a470dd50f9f74fc80147e025acb2b88b3a4c8d100a07b3c159097e56950eeee7a71c490ff2dea85a7fb92b4f354c7d8f3bedb1fb13854f07bb8

Score

10^/10

qakbot obama105 1632821932 banker evasion stealer trojan

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

http://101.99.90.160/44467.7331923611.dat

xlm40.dropper

http://188.165.62.4/44467.7331923611.dat

xlm40.dropper

http://84.32.188.42/44467.7331923611.dat

xlm40.dropper

http://101.99.90.160/44467.7348045139.dat

xlm40.dropper

http://188.165.62.4/44467.7348045139.dat

xlm40.dropper

http://84.32.188.42/44467.7348045139.dat

Extracted

Family

qakbot

Version

402.363

Botnet

obama105

Campaign

1632821932

120.151.47.189:443

41.228.22.180:443

39.52.241.3:995

199.27.127.129:443

216.201.162.158:443

136.232.34.70:443

196.217.156.63:995

120.150.218.241:995

95.77.223.148:443

185.250.148.74:443

181.118.183.94:443

105.198.236.99:443

140.82.49.12:443

37.210.152.224:995

89.101.97.139:443

81.241.252.59:2078

27.223.92.142:995

81.250.153.227:2222

73.151.236.31:443

47.22.148.6:443

Signatures

Process spawned unexpected child process 6 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

regsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	668	1580	regsvr32.exe	EXCEL.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	524	1580	regsvr32.exe	EXCEL.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1068	1580	regsvr32.exe	EXCEL.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	968	1580	regsvr32.exe	EXCEL.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1012	1580	regsvr32.exe	EXCEL.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	2020	1580	regsvr32.exe	EXCEL.EXE

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Downloads MZ/PE file
Loads dropped DLL 4 IoCs

Processes:

regsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exe

pid process

1068 regsvr32.exe
2004 regsvr32.exe
968 regsvr32.exe
1012 regsvr32.exe

pid	process
1068	regsvr32.exe
2004	regsvr32.exe
968	regsvr32.exe
1012	regsvr32.exe

Drops file in System32 directory 6 IoCs

Processes:

explorer.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357	explorer.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\t4[1]	explorer.exe

Office loads VBA resources, possible macro or embedded object present
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1844 schtasks.exe
Discovers systems in the same network 1 TTPs 1 IoCs
discovery

Remote System Discovery
T1018

Processes:

net.exe

pid process

1732 net.exe
Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

EXCEL.EXE

description ioc process

Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command-Line Interface
T1059

Processes:

ipconfig.exenetstat.exe

pid process

864 ipconfig.exe
1792 netstat.exe

pid	process
1844	schtasks.exe

pid	process
1732	net.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

pid	process
864	ipconfig.exe
1792	netstat.exe

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

EXCEL.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE

Modifies data under HKEY_USERS 64 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Aqgmayuqwyzvv\787d25ab = 96d10d4ce07705c1ef65b3145a07e02a6f6984401ef63b9e4ab8cb19242d19a251d00f7cc367a0a9be3aa7dadfbd9c56fa07d8a5841a59aeb977	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	explorer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Aqgmayuqwyzvv\787d25ab = 96d1044ce07705c1ef65b25e5a0eea2e65688a4750fd359c4cb3c92f4fb9f1a1dbe98dc92266d1579763ead1f67c03401c	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-42-f0-13-0a-82	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecision = "0"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Aqgmayuqwyzvv	explorer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Aqgmayuqwyzvv\d035cd5c = 908d1875568dbfe68f4dcfac22037d7225d0ddf32f38148b3fd27caf12968d9c7c08d5703c82	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Aqgmayuqwyzvv\4de2f5e5 = 093c9bb970ad81d90efcf60273012addfd64a77d7a574b0a53fa43f51a37c066d1dd1585a1918d7656a662f49f5586b53bbf872ebacc23289f00978967d035f60c5a492dcfa10c3bebc64da94c61b6eb08b75ef1e6525e8e472f2d7cb1b5b6a46dd387521a3d0a0400be09a3e184be93b3eeb98b9ba85595eba47a11ff5ac900305541984659e566f9d3a8ccbe59b4ffac43d967669e8c7ccb964d38c87b0d6b841598	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecisionReason = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-42-f0-13-0a-82\WpadDecisionTime = 60d9438790b4d701	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Aqgmayuqwyzvv\4fa3d599 = 130a5d0a5a92c4a2e9048b77e643cdf9c4	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Aqgmayuqwyzvv\8a17fd76 = f5867ec730eb04abcc5560db62edc0cb44e190024bfafcbe61e732e88a28b9c2ffab9ec8319d36063aca0795fdf725d92c0ece798b276d1d18310fff6205ccda8c1c037e98e3be15443eaa81fdd94d034fb108	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecisionTime = 60d9438790b4d701	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-42-f0-13-0a-82\WpadDecision = "0"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Aqgmayuqwyzvv\787d25ab = 96d1134ce07730a2788eb499608f59fe078e926b8081b1045b453be7	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Aqgmayuqwyzvv\f71fb2fc = e108b196778aa4e144d2190443e0875f2c587a52310242c114053eef90b4c6583bd11571f0297073219d83af6dbbade21083a949e71822be28459bd27b25e3b02081281692602052f508849f126f2350f8f6d15f4fc392e1ebe082b7	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Aqgmayuqwyzvv\7344a5d = 630c5b312e1e2267aaab69b1d70099a2105c584b0694757fc535aac913cdc3312249cabf7c99f7	explorer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-42-f0-13-0a-82\WpadDecisionReason = "1"	explorer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadNetworkName = "Network"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\aa-42-f0-13-0a-82	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Aqgmayuqwyzvv\32ab9a13 = 6abf475788840d14e33c42066ee28f	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Aqgmayuqwyzvv\f55e9280 = 700e8db1ec87bf56a2c57833535eb93e2537cf0b3f0881f59a6d	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}	explorer.exe

Modifies registry class 64 IoCs

Processes:

EXCEL.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node\Interface\{4C599243-6926-101B-9992-00000B65C6F9}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3}\ = "MdcListEvents"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Interface\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents5"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C29D9919-81B7-4640-8F0A-8890CD995847}\2.0\FLAGS	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\TypeLib	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB}	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00024518-0000-0000-C000-000000000046}\ = "IRefDummy"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents4"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080}\ = "IPage"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{05AC01BF-653A-49D6-83B2-1BEC70915409}\1.2\FLAGS	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}\ = "ITabStrip"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Interface\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLPassword"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776}\ = "SpinbuttonEvents"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074}\ = "IReturnString"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}\ = "TabStripEvents"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents1"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080}\ = "IPage"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}\ = "ITabStrip"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Interface\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}\ = "WHTMLControlEvents"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776}\ = "SpinbuttonEvents"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C29D9919-81B7-4640-8F0A-8890CD995847}\2.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VBE"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node\Interface\{944ACF93-A1E6-11CE-8104-00AA00611080}\ = "Tabs"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D}	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Interface\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C29D9919-81B7-4640-8F0A-8890CD995847}\2.0	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}\ = "FormEvents"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9}	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Interface\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C29D9919-81B7-4640-8F0A-8890CD995847}\2.0\ = "Microsoft Forms 2.0 Object Library"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}\ = "Controls"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01}	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node\Interface\{47FF8FE8-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents9"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}\ = "RefEvents"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Interface	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node\Interface\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C29D9919-81B7-4640-8F0A-8890CD995847}\2.0\0\win32	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Interface\{4C599243-6926-101B-9992-00000B65C6F9}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}\ = "MdcTextEvents"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents2"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Interface\{92E11A03-7358-11CE-80CB-00AA00611080}	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{05AC01BF-653A-49D6-83B2-1BEC70915409}\1.2	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69}\ = "IDataAutoWrapper"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074}\ = "IReturnSingle"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Interface\{4C599243-6926-101B-9992-00000B65C6F9}\ = "IImage"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{05AC01BF-653A-49D6-83B2-1BEC70915409}\1.2\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VBE\\RefEdit.exd"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Interface\{04598FC1-866C-11CF-AB7C-00AA00C08FCF}	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node\Interface\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}\ = "MdcTextEvents"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcText"	EXCEL.EXE

Runs net.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1580 EXCEL.EXE
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

regsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeexplorer.exe

pid process

1068 regsvr32.exe
2004 regsvr32.exe
968 regsvr32.exe
1012 regsvr32.exe
308 explorer.exe
Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

regsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exe

pid process

1068 regsvr32.exe
2004 regsvr32.exe
968 regsvr32.exe
1012 regsvr32.exe

pid	process
1068	regsvr32.exe
2004	regsvr32.exe
968	regsvr32.exe
1012	regsvr32.exe
308	explorer.exe

pid	process
1068	regsvr32.exe
2004	regsvr32.exe
968	regsvr32.exe
1012	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

EXCEL.EXEwhoami.exe

description	pid	process
Token: SeShutdownPrivilege	1580	EXCEL.EXE
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe
Token: SeDebugPrivilege	832	whoami.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

EXCEL.EXE

pid process

1580 EXCEL.EXE
1580 EXCEL.EXE

Suspicious use of SetWindowsHookEx 11 IoCs

Processes:

EXCEL.EXE

pid	process
1580	EXCEL.EXE
1580	EXCEL.EXE
1580	EXCEL.EXE
1580	EXCEL.EXE
1580	EXCEL.EXE
1580	EXCEL.EXE
1580	EXCEL.EXE
1580	EXCEL.EXE
1580	EXCEL.EXE
1580	EXCEL.EXE
1580	EXCEL.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

EXCEL.EXEregsvr32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1580 wrote to memory of 668	1580	EXCEL.EXE	regsvr32.exe
PID 1580 wrote to memory of 668	1580	EXCEL.EXE	regsvr32.exe
PID 1580 wrote to memory of 668	1580	EXCEL.EXE	regsvr32.exe
PID 1580 wrote to memory of 668	1580	EXCEL.EXE	regsvr32.exe
PID 1580 wrote to memory of 668	1580	EXCEL.EXE	regsvr32.exe
PID 1580 wrote to memory of 668	1580	EXCEL.EXE	regsvr32.exe
PID 1580 wrote to memory of 668	1580	EXCEL.EXE	regsvr32.exe
PID 1580 wrote to memory of 524	1580	EXCEL.EXE	regsvr32.exe
PID 1580 wrote to memory of 524	1580	EXCEL.EXE	regsvr32.exe
PID 1580 wrote to memory of 524	1580	EXCEL.EXE	regsvr32.exe
PID 1580 wrote to memory of 524	1580	EXCEL.EXE	regsvr32.exe
PID 1580 wrote to memory of 524	1580	EXCEL.EXE	regsvr32.exe
PID 1580 wrote to memory of 524	1580	EXCEL.EXE	regsvr32.exe
PID 1580 wrote to memory of 524	1580	EXCEL.EXE	regsvr32.exe
PID 1580 wrote to memory of 1068	1580	EXCEL.EXE	regsvr32.exe
PID 1580 wrote to memory of 1068	1580	EXCEL.EXE	regsvr32.exe
PID 1580 wrote to memory of 1068	1580	EXCEL.EXE	regsvr32.exe
PID 1580 wrote to memory of 1068	1580	EXCEL.EXE	regsvr32.exe
PID 1580 wrote to memory of 1068	1580	EXCEL.EXE	regsvr32.exe
PID 1580 wrote to memory of 1068	1580	EXCEL.EXE	regsvr32.exe
PID 1580 wrote to memory of 1068	1580	EXCEL.EXE	regsvr32.exe
PID 1068 wrote to memory of 1912	1068	regsvr32.exe	explorer.exe
PID 1068 wrote to memory of 1912	1068	regsvr32.exe	explorer.exe
PID 1068 wrote to memory of 1912	1068	regsvr32.exe	explorer.exe
PID 1068 wrote to memory of 1912	1068	regsvr32.exe	explorer.exe
PID 1068 wrote to memory of 1912	1068	regsvr32.exe	explorer.exe
PID 1068 wrote to memory of 1912	1068	regsvr32.exe	explorer.exe
PID 1912 wrote to memory of 1844	1912	explorer.exe	schtasks.exe
PID 1912 wrote to memory of 1844	1912	explorer.exe	schtasks.exe
PID 1912 wrote to memory of 1844	1912	explorer.exe	schtasks.exe
PID 1912 wrote to memory of 1844	1912	explorer.exe	schtasks.exe
PID 2028 wrote to memory of 816	2028	taskeng.exe	regsvr32.exe
PID 2028 wrote to memory of 816	2028	taskeng.exe	regsvr32.exe
PID 2028 wrote to memory of 816	2028	taskeng.exe	regsvr32.exe
PID 2028 wrote to memory of 816	2028	taskeng.exe	regsvr32.exe
PID 2028 wrote to memory of 816	2028	taskeng.exe	regsvr32.exe
PID 816 wrote to memory of 2004	816	regsvr32.exe	regsvr32.exe
PID 816 wrote to memory of 2004	816	regsvr32.exe	regsvr32.exe
PID 816 wrote to memory of 2004	816	regsvr32.exe	regsvr32.exe
PID 816 wrote to memory of 2004	816	regsvr32.exe	regsvr32.exe
PID 816 wrote to memory of 2004	816	regsvr32.exe	regsvr32.exe
PID 816 wrote to memory of 2004	816	regsvr32.exe	regsvr32.exe
PID 816 wrote to memory of 2004	816	regsvr32.exe	regsvr32.exe
PID 2004 wrote to memory of 308	2004	regsvr32.exe	explorer.exe
PID 2004 wrote to memory of 308	2004	regsvr32.exe	explorer.exe
PID 2004 wrote to memory of 308	2004	regsvr32.exe	explorer.exe
PID 2004 wrote to memory of 308	2004	regsvr32.exe	explorer.exe
PID 2004 wrote to memory of 308	2004	regsvr32.exe	explorer.exe
PID 2004 wrote to memory of 308	2004	regsvr32.exe	explorer.exe
PID 308 wrote to memory of 1888	308	explorer.exe	reg.exe
PID 308 wrote to memory of 1888	308	explorer.exe	reg.exe
PID 308 wrote to memory of 1888	308	explorer.exe	reg.exe
PID 308 wrote to memory of 1888	308	explorer.exe	reg.exe
PID 308 wrote to memory of 1036	308	explorer.exe	reg.exe
PID 308 wrote to memory of 1036	308	explorer.exe	reg.exe
PID 308 wrote to memory of 1036	308	explorer.exe	reg.exe
PID 308 wrote to memory of 1036	308	explorer.exe	reg.exe
PID 1580 wrote to memory of 968	1580	EXCEL.EXE	regsvr32.exe
PID 1580 wrote to memory of 968	1580	EXCEL.EXE	regsvr32.exe
PID 1580 wrote to memory of 968	1580	EXCEL.EXE	regsvr32.exe
PID 1580 wrote to memory of 968	1580	EXCEL.EXE	regsvr32.exe
PID 1580 wrote to memory of 968	1580	EXCEL.EXE	regsvr32.exe
PID 1580 wrote to memory of 968	1580	EXCEL.EXE	regsvr32.exe
PID 1580 wrote to memory of 968	1580	EXCEL.EXE	regsvr32.exe

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\CompensationClaim-68254946-09282021.xls
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1580

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 -silent ..\Drezd.red
2⤵
- Process spawned unexpected child process
PID:668

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 -silent ..\Drezd1.red
2⤵
- Process spawned unexpected child process
PID:524

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 -silent ..\Drezd2.red
2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1068

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1912

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn wpocnxftgn /tr "regsvr32.exe -s \"C:\Users\Admin\Drezd2.red\"" /SC ONCE /Z /ST 17:38 /ET 17:50
4⤵
- Creates scheduled task(s)
PID:1844

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 -silent ..\Drezd.red
2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:968

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
PID:1660

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 -silent ..\Drezd1.red
2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1012

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
PID:1140

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 -silent ..\Drezd2.red
2⤵
- Process spawned unexpected child process
PID:2020

C:\Windows\system32\taskeng.exe
taskeng.exe {8F45A940-7553-4935-A4A2-F002DA6CA44F} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2028

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\Drezd2.red"
2⤵
- Suspicious use of WriteProcessMemory
PID:816

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\Drezd2.red"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2004

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:308

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Mcypg" /d "0"
5⤵
PID:1888

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Dvysyjnbwzhu" /d "0"
5⤵
PID:1036

C:\Windows\SysWOW64\whoami.exe
whoami /all
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:832

C:\Windows\SysWOW64\cmd.exe
cmd /c set
5⤵
PID:1592

C:\Windows\SysWOW64\arp.exe
arp -a
5⤵
PID:1120

C:\Windows\SysWOW64\ipconfig.exe
ipconfig /all
5⤵
- Gathers network information
PID:864

C:\Windows\SysWOW64\net.exe
net view /all
5⤵
- Discovers systems in the same network
PID:1732

C:\Windows\SysWOW64\nslookup.exe
nslookup -querytype=ALL -timeout=10 _ldap._tcp.dc._msdcs.WORKGROUP
5⤵
PID:1440

C:\Windows\SysWOW64\net.exe
net share
5⤵
PID:1748

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 share
6⤵
PID:516

C:\Windows\SysWOW64\route.exe
route print
5⤵
PID:1640

C:\Windows\SysWOW64\netstat.exe
netstat -nao
5⤵
- Gathers network information
PID:1792

C:\Windows\SysWOW64\net.exe
net localgroup
5⤵
PID:816

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup
6⤵
PID:984

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:972

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Command-Line Interface

T1059

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Drezd.red
MD5
ab8c8cc09d957afa7ca748011d8ae2d5

SHA1
fc4e881c04b30da109555901e28e10de5fbd42e5

SHA256
09c8d348a81e3a8688e44a78b4fcb1577163fcba3f36fcb116950a3814edccd7

SHA512
e6e0f4d4ca4ff12d025c728dddd18ae47b95769b1a40e28e5f5bdb7ff153a089901c380d262259a729e20a8022fe589a6f681db9cec71f8940dfdaa84dcbb440

Download Submit
C:\Users\Admin\Drezd1.red
MD5
ab8c8cc09d957afa7ca748011d8ae2d5

SHA1
fc4e881c04b30da109555901e28e10de5fbd42e5

SHA256
09c8d348a81e3a8688e44a78b4fcb1577163fcba3f36fcb116950a3814edccd7

SHA512
e6e0f4d4ca4ff12d025c728dddd18ae47b95769b1a40e28e5f5bdb7ff153a089901c380d262259a729e20a8022fe589a6f681db9cec71f8940dfdaa84dcbb440

Download Submit
C:\Users\Admin\Drezd2.red
MD5
9194492ef8c1903e4cd81c16f6bc654d

SHA1
d0ff82ce8aebd68197ea5308840209855b07432e

SHA256
4c08341e0c574bfd2aaaf7ec5286625be6a93af79460a708daeaf0a3a2d21420

SHA512
73a8df2c85b8bd7d258e8a6aa9b3a6acb7b52b2fed356bd2c34f79422062ee334f44cf4affb7f4893ce17f016ce23bdbfb05540c37e5d6b5ac8042f76f3e3a36

Download Submit
C:\Users\Admin\Drezd2.red
MD5
ab8c8cc09d957afa7ca748011d8ae2d5

SHA1
fc4e881c04b30da109555901e28e10de5fbd42e5

SHA256
09c8d348a81e3a8688e44a78b4fcb1577163fcba3f36fcb116950a3814edccd7

SHA512
e6e0f4d4ca4ff12d025c728dddd18ae47b95769b1a40e28e5f5bdb7ff153a089901c380d262259a729e20a8022fe589a6f681db9cec71f8940dfdaa84dcbb440

Download Submit
C:\Users\Admin\Drezd2.red
MD5
ab8c8cc09d957afa7ca748011d8ae2d5

SHA1
fc4e881c04b30da109555901e28e10de5fbd42e5

SHA256
09c8d348a81e3a8688e44a78b4fcb1577163fcba3f36fcb116950a3814edccd7

SHA512
e6e0f4d4ca4ff12d025c728dddd18ae47b95769b1a40e28e5f5bdb7ff153a089901c380d262259a729e20a8022fe589a6f681db9cec71f8940dfdaa84dcbb440

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\Drezd.red
MD5
ab8c8cc09d957afa7ca748011d8ae2d5

SHA1
fc4e881c04b30da109555901e28e10de5fbd42e5

SHA256
09c8d348a81e3a8688e44a78b4fcb1577163fcba3f36fcb116950a3814edccd7

SHA512
e6e0f4d4ca4ff12d025c728dddd18ae47b95769b1a40e28e5f5bdb7ff153a089901c380d262259a729e20a8022fe589a6f681db9cec71f8940dfdaa84dcbb440

Download Submit
\Users\Admin\Drezd1.red
MD5
ab8c8cc09d957afa7ca748011d8ae2d5

SHA1
fc4e881c04b30da109555901e28e10de5fbd42e5

SHA256
09c8d348a81e3a8688e44a78b4fcb1577163fcba3f36fcb116950a3814edccd7

SHA512
e6e0f4d4ca4ff12d025c728dddd18ae47b95769b1a40e28e5f5bdb7ff153a089901c380d262259a729e20a8022fe589a6f681db9cec71f8940dfdaa84dcbb440

Download Submit
\Users\Admin\Drezd2.red
MD5
ab8c8cc09d957afa7ca748011d8ae2d5

SHA1
fc4e881c04b30da109555901e28e10de5fbd42e5

SHA256
09c8d348a81e3a8688e44a78b4fcb1577163fcba3f36fcb116950a3814edccd7

SHA512
e6e0f4d4ca4ff12d025c728dddd18ae47b95769b1a40e28e5f5bdb7ff153a089901c380d262259a729e20a8022fe589a6f681db9cec71f8940dfdaa84dcbb440

Download Submit
\Users\Admin\Drezd2.red
MD5
ab8c8cc09d957afa7ca748011d8ae2d5

SHA1
fc4e881c04b30da109555901e28e10de5fbd42e5

SHA256
09c8d348a81e3a8688e44a78b4fcb1577163fcba3f36fcb116950a3814edccd7

SHA512
e6e0f4d4ca4ff12d025c728dddd18ae47b95769b1a40e28e5f5bdb7ff153a089901c380d262259a729e20a8022fe589a6f681db9cec71f8940dfdaa84dcbb440

Download Submit
memory/308-95-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/308-90-0x0000000000000000-mapping.dmp

Download
memory/516-129-0x0000000000000000-mapping.dmp

Download
memory/524-68-0x0000000000000000-mapping.dmp

Download
memory/668-66-0x0000000000000000-mapping.dmp

Download
memory/816-82-0x0000000000000000-mapping.dmp

Download
memory/816-83-0x000007FEFB7B1000-0x000007FEFB7B3000-memory.dmp

Filesize
8KB

Download
memory/816-132-0x0000000000000000-mapping.dmp

Download
memory/832-121-0x0000000000000000-mapping.dmp

Download
memory/864-124-0x0000000000000000-mapping.dmp

Download
memory/968-103-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/968-102-0x000000006BC40000-0x000000006BD12000-memory.dmp

Filesize
840KB

Download
memory/968-97-0x0000000000000000-mapping.dmp

Download
memory/984-133-0x0000000000000000-mapping.dmp

Download
memory/1012-107-0x0000000000000000-mapping.dmp

Download
memory/1012-113-0x000000006BC40000-0x000000006BD12000-memory.dmp

Filesize
840KB

Download
memory/1036-96-0x0000000000000000-mapping.dmp

Download
memory/1068-76-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/1068-74-0x000000006BC40000-0x000000006BC61000-memory.dmp

Filesize
132KB

Download
memory/1068-75-0x000000006BC40000-0x000000006BD12000-memory.dmp

Filesize
840KB

Download
memory/1068-70-0x0000000000000000-mapping.dmp

Download
memory/1120-123-0x0000000000000000-mapping.dmp

Download
memory/1140-114-0x0000000000000000-mapping.dmp

Download
memory/1140-120-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1440-127-0x0000000000000000-mapping.dmp

Download
memory/1580-62-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1580-63-0x0000000075511000-0x0000000075513000-memory.dmp

Filesize
8KB

Download
memory/1580-64-0x000000006C911000-0x000000006C913000-memory.dmp

Filesize
8KB

Download
memory/1580-60-0x000000002F771000-0x000000002F774000-memory.dmp

Filesize
12KB

Download
memory/1580-61-0x0000000070FB1000-0x0000000070FB3000-memory.dmp

Filesize
8KB

Download
memory/1580-65-0x0000000006100000-0x0000000006102000-memory.dmp

Filesize
8KB

Download
memory/1592-122-0x0000000000000000-mapping.dmp

Download
memory/1640-130-0x0000000000000000-mapping.dmp

Download
memory/1660-111-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1660-104-0x0000000000000000-mapping.dmp

Download
memory/1732-126-0x0000000000000000-mapping.dmp

Download
memory/1748-128-0x0000000000000000-mapping.dmp

Download
memory/1792-131-0x0000000000000000-mapping.dmp

Download
memory/1844-80-0x0000000000000000-mapping.dmp

Download
memory/1888-93-0x0000000000000000-mapping.dmp

Download
memory/1912-77-0x0000000000000000-mapping.dmp

Download
memory/1912-79-0x000000006BA31000-0x000000006BA33000-memory.dmp

Filesize
8KB

Download
memory/1912-81-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/2004-94-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/2004-85-0x0000000000000000-mapping.dmp

Download
memory/2004-88-0x000000006B240000-0x000000006B261000-memory.dmp

Filesize
132KB

Download
memory/2004-89-0x000000006B240000-0x000000006B312000-memory.dmp

Filesize
840KB

Download
memory/2020-117-0x0000000000000000-mapping.dmp

Download