Analysis
-
max time kernel
587s -
max time network
597s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
28-09-2021 15:35
Static task
static1
Behavioral task
behavioral1
Sample
CompensationClaim-68254946-09282021.xls
Resource
win7v20210408
Behavioral task
behavioral2
Sample
CompensationClaim-68254946-09282021.xls
Resource
win10-en-20210920
General
-
Target
CompensationClaim-68254946-09282021.xls
-
Size
137KB
-
MD5
e0574cf808d9b7150bac6b894baec9f0
-
SHA1
6603fa83dbb84f3a0d35982a37dbc5250699a64a
-
SHA256
7fddbdbd20255e29207d6765f7c3d19a235be7e55ca6184a76a74c2175da8bf4
-
SHA512
9f98689c83358a470dd50f9f74fc80147e025acb2b88b3a4c8d100a07b3c159097e56950eeee7a71c490ff2dea85a7fb92b4f354c7d8f3bedb1fb13854f07bb8
Malware Config
Extracted
http://101.99.90.160/44467.6499013889.dat
http://188.165.62.4/44467.6499013889.dat
http://84.32.188.42/44467.6499013889.dat
Extracted
qakbot
402.363
obama105
1632821932
120.151.47.189:443
41.228.22.180:443
39.52.241.3:995
199.27.127.129:443
216.201.162.158:443
136.232.34.70:443
196.217.156.63:995
120.150.218.241:995
95.77.223.148:443
185.250.148.74:443
181.118.183.94:443
105.198.236.99:443
140.82.49.12:443
37.210.152.224:995
89.101.97.139:443
81.241.252.59:2078
27.223.92.142:995
81.250.153.227:2222
73.151.236.31:443
47.22.148.6:443
122.11.220.212:2222
76.25.142.196:443
75.66.88.33:443
45.46.53.140:2222
173.25.166.81:443
103.148.120.144:443
173.21.10.71:2222
186.18.205.199:995
71.74.12.34:443
67.165.206.193:993
47.40.196.233:2222
68.204.7.158:443
24.229.150.54:995
109.12.111.14:443
177.130.82.197:2222
72.252.201.69:443
24.55.112.61:443
24.139.72.117:443
187.156.138.172:443
71.80.168.245:443
82.77.137.101:995
173.234.155.233:443
75.188.35.168:443
5.238.149.235:61202
73.77.87.137:443
182.176.112.182:443
96.37.113.36:993
162.244.227.34:443
92.59.35.196:2222
196.218.227.241:995
68.207.102.78:443
2.188.27.77:443
189.210.115.207:443
181.163.96.53:443
75.107.26.196:465
185.250.148.74:2222
68.186.192.69:443
Extracted
qakbot
402.363
notset
1632819510
196.217.156.63:995
120.150.218.241:995
95.77.223.148:443
185.250.148.74:443
181.118.183.94:443
105.198.236.99:443
140.82.49.12:443
37.210.152.224:995
89.101.97.139:443
81.241.252.59:2078
27.223.92.142:995
81.250.153.227:2222
73.151.236.31:443
47.22.148.6:443
122.11.220.212:2222
120.151.47.189:443
199.27.127.129:443
216.201.162.158:443
136.232.34.70:443
76.25.142.196:443
75.66.88.33:443
45.46.53.140:2222
173.25.166.81:443
103.148.120.144:443
173.21.10.71:2222
186.18.205.199:995
71.74.12.34:443
67.165.206.193:993
47.40.196.233:2222
68.204.7.158:443
24.229.150.54:995
109.12.111.14:443
177.130.82.197:2222
72.252.201.69:443
24.55.112.61:443
24.139.72.117:443
187.156.138.172:443
71.80.168.245:443
82.77.137.101:995
173.234.155.233:443
75.188.35.168:443
5.238.149.235:61202
73.77.87.137:443
182.176.112.182:443
96.37.113.36:993
162.244.227.34:443
92.59.35.196:2222
196.218.227.241:995
68.207.102.78:443
2.188.27.77:443
189.210.115.207:443
181.163.96.53:443
75.107.26.196:465
185.250.148.74:2222
68.186.192.69:443
Signatures
-
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
regsvr32.exeregsvr32.exeregsvr32.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3992 2372 regsvr32.exe EXCEL.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 1196 2372 regsvr32.exe EXCEL.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3780 2372 regsvr32.exe EXCEL.EXE -
Downloads MZ/PE file
-
Loads dropped DLL 5 IoCs
Processes:
regsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exepid process 3788 regsvr32.exe 1964 regsvr32.exe 2536 regsvr32.exe 1608 regsvr32.exe 3536 regsvr32.exe -
Drops file in System32 directory 6 IoCs
Processes:
explorer.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 explorer.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE explorer.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies explorer.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 explorer.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\t4[1] explorer.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat explorer.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Discovers systems in the same network 1 TTPs 1 IoCs
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exenetstat.exepid process 3708 ipconfig.exe 1528 netstat.exe -
Modifies data under HKEY_USERS 63 IoCs
Processes:
explorer.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Ygeuebfejdiir\cb17129 = ae9ffa413716e748a4de8b814e319957effccaea572ba62d5640b275b9b56302e19e57f0ba71300d3c8d84c63fea248cec3077b57aa1efc76d0f70e4564103913f5b64e1a9d5e09bcdfd4efa18646949c8fe5e531ab984795ad90f915d53dfc6ec851c32fa354f explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs explorer.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Ygeuebfejdiir\392ea167 = f327c4d44caf785488c724c5707578b89139aec624c8b3ba95894a4beba74a481ca2694b23fa0b98985565dcc3c7baa30d547890340e4341a7fed12c5c6da5cc49d2cf37421c536d9ce45fb35e574737ce8d0b60a90f6bf7fb9384a0418601cfd1b6835faccfb317e46bda26a2c278a7fe8fa0d3696cea2a212804117eb8deea11f0b566687e4f4c214c7986a7aab8eb43144ed4644814c566fe5989ff358ca9d7 explorer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Ygeuebfejdiir\3b6f811b = 3dcb602541840c41035d28feba3bc4754d06c74e0b8913b12684b5a0bbe4fcc27fcb9a1871cbbfd168ebdddb02b0c8e58201 explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Ygeuebfejdiir\8192c602 = d82490f83308cf6fd15f7f4800779ac715e28bad986d8519d4071129f198d672215f72b70f295fb4c7215d62fb89464a6d1da0c9eccc4cc22e6519ce30c4654917b87e2094ddc5f8b8083d169f12e41a5d02 explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Ygeuebfejdiir\fedba9f4 = dafe6389e90a5335d5fa05c10b035e5d3a72224f325122de776bda30f04132e2f4d80cd9e1454dc8ae954dde757674c114717fc2028321d360 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Ygeuebfejdiir\cb17129 = ae9fed413716d2def583d1490749ca359e8a9cb7b93a16612197991951f357d193f0aedc142988233b4cdb45cfd22ec0a1a06f8716ecc42502e6bd026d754a991f124e6263d9165a5aeb32a8e5fa571222d07ef1f3ab834616310aeb65adfad99d20905fb7f3e97bcbf767135bce05a8b382b03735d5cf83ec376519 explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs explorer.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Ygeuebfejdiir explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Ygeuebfejdiir\cb17129 = ae9fed413716d2def583d1490749ca359e8a9cb7b93a1661229e981951f357d193f0aedc142988233b4cdb45cfd22ec0a1a06f8716ecc42502e6bd026d754a991f124e6263d9165a5aeb32a8e5fa571222d07ef1f3ab834616310aeb65adfad99d20905fb7f3e97bcbf767135bce05a8b382b03735d5cf83ec376519 explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Ygeuebfejdiir\73f81edf = 895b5c1af4d1fecc8a7cf660522067b0358e3f071101b358a9759953eee95ff55427a72beb12d7d3ac99b80c39f7f724733f96b2d8514e35516b46919da54b884304b45c9b5c6491f11d2920eb2b4c41358804ff1c35f749273677717a1a explorer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" explorer.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Ygeuebfejdiir\4667ce91 = ae34973500c204ce24bd4a2cd6a56e76e58fbfd8e677f005a3e3b1cf7de266c9edb153977e2882c3dfee402ae6aca7a305dfebda3d27ebf4102d46973f1ee9dba42ea3646251d21213d423b9f8178a6ea7ddeb352ecb1fd0ebc512a1 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Ygeuebfejdiir\cb17129 = ae9fe4413716d2def583d0030740c030968392b5f7311960259c9b2fcfa1098f14b2d58c47ceaf253f248882d1c3839fad8b95fc2b5592785777eadb71a591fba2d0c99dc8b6aa794c3936ed508c621805c5f62eb2d46702a7b65295ce241ee8a0ebb25810ff45c5ca0df76e1e6880db97b32ee41ca6edc583a797ed5aa8893c7e4f6050ae explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Ygeuebfejdiir\83d3e67e = f8d74eadca3c53e1cc70f24d7469e44c150753b641c85e42e7a9a49eb9a1723067d54dd9a5c3be97 explorer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" explorer.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates explorer.exe -
Runs net.exe
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 2372 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
regsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeexplorer.exeregsvr32.exepid process 3788 regsvr32.exe 3788 regsvr32.exe 1964 regsvr32.exe 1964 regsvr32.exe 2536 regsvr32.exe 2536 regsvr32.exe 1608 regsvr32.exe 1608 regsvr32.exe 1424 explorer.exe 1424 explorer.exe 3536 regsvr32.exe 3536 regsvr32.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
regsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeexplorer.exepid process 3788 regsvr32.exe 1964 regsvr32.exe 2536 regsvr32.exe 1608 regsvr32.exe 3536 regsvr32.exe 420 explorer.exe -
Suspicious use of AdjustPrivilegeToken 29 IoCs
Processes:
whoami.exenetstat.exemsiexec.exedescription pid process Token: SeDebugPrivilege 3968 whoami.exe Token: SeDebugPrivilege 3968 whoami.exe Token: SeDebugPrivilege 3968 whoami.exe Token: SeDebugPrivilege 3968 whoami.exe Token: SeDebugPrivilege 3968 whoami.exe Token: SeDebugPrivilege 3968 whoami.exe Token: SeDebugPrivilege 3968 whoami.exe Token: SeDebugPrivilege 3968 whoami.exe Token: SeDebugPrivilege 3968 whoami.exe Token: SeDebugPrivilege 3968 whoami.exe Token: SeDebugPrivilege 3968 whoami.exe Token: SeDebugPrivilege 3968 whoami.exe Token: SeDebugPrivilege 3968 whoami.exe Token: SeDebugPrivilege 3968 whoami.exe Token: SeDebugPrivilege 3968 whoami.exe Token: SeDebugPrivilege 3968 whoami.exe Token: SeDebugPrivilege 3968 whoami.exe Token: SeDebugPrivilege 3968 whoami.exe Token: SeDebugPrivilege 3968 whoami.exe Token: SeDebugPrivilege 3968 whoami.exe Token: SeDebugPrivilege 3968 whoami.exe Token: SeDebugPrivilege 3968 whoami.exe Token: SeDebugPrivilege 3968 whoami.exe Token: SeDebugPrivilege 3968 whoami.exe Token: SeDebugPrivilege 3968 whoami.exe Token: SeDebugPrivilege 3968 whoami.exe Token: SeDebugPrivilege 3968 whoami.exe Token: SeDebugPrivilege 1528 netstat.exe Token: SeSecurityPrivilege 2480 msiexec.exe -
Suspicious use of SetWindowsHookEx 28 IoCs
Processes:
EXCEL.EXEpid process 2372 EXCEL.EXE 2372 EXCEL.EXE 2372 EXCEL.EXE 2372 EXCEL.EXE 2372 EXCEL.EXE 2372 EXCEL.EXE 2372 EXCEL.EXE 2372 EXCEL.EXE 2372 EXCEL.EXE 2372 EXCEL.EXE 2372 EXCEL.EXE 2372 EXCEL.EXE 2372 EXCEL.EXE 2372 EXCEL.EXE 2372 EXCEL.EXE 2372 EXCEL.EXE 2372 EXCEL.EXE 2372 EXCEL.EXE 2372 EXCEL.EXE 2372 EXCEL.EXE 2372 EXCEL.EXE 2372 EXCEL.EXE 2372 EXCEL.EXE 2372 EXCEL.EXE 2372 EXCEL.EXE 2372 EXCEL.EXE 2372 EXCEL.EXE 2372 EXCEL.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
EXCEL.EXEregsvr32.exeregsvr32.exeregsvr32.exeexplorer.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeexplorer.exedescription pid process target process PID 2372 wrote to memory of 3992 2372 EXCEL.EXE regsvr32.exe PID 2372 wrote to memory of 3992 2372 EXCEL.EXE regsvr32.exe PID 3992 wrote to memory of 3788 3992 regsvr32.exe regsvr32.exe PID 3992 wrote to memory of 3788 3992 regsvr32.exe regsvr32.exe PID 3992 wrote to memory of 3788 3992 regsvr32.exe regsvr32.exe PID 3788 wrote to memory of 1424 3788 regsvr32.exe explorer.exe PID 3788 wrote to memory of 1424 3788 regsvr32.exe explorer.exe PID 3788 wrote to memory of 1424 3788 regsvr32.exe explorer.exe PID 3788 wrote to memory of 1424 3788 regsvr32.exe explorer.exe PID 3788 wrote to memory of 1424 3788 regsvr32.exe explorer.exe PID 2372 wrote to memory of 1196 2372 EXCEL.EXE regsvr32.exe PID 2372 wrote to memory of 1196 2372 EXCEL.EXE regsvr32.exe PID 1196 wrote to memory of 1964 1196 regsvr32.exe regsvr32.exe PID 1196 wrote to memory of 1964 1196 regsvr32.exe regsvr32.exe PID 1196 wrote to memory of 1964 1196 regsvr32.exe regsvr32.exe PID 1424 wrote to memory of 1688 1424 explorer.exe schtasks.exe PID 1424 wrote to memory of 1688 1424 explorer.exe schtasks.exe PID 1424 wrote to memory of 1688 1424 explorer.exe schtasks.exe PID 1964 wrote to memory of 1468 1964 regsvr32.exe explorer.exe PID 1964 wrote to memory of 1468 1964 regsvr32.exe explorer.exe PID 1964 wrote to memory of 1468 1964 regsvr32.exe explorer.exe PID 1964 wrote to memory of 1468 1964 regsvr32.exe explorer.exe PID 1964 wrote to memory of 1468 1964 regsvr32.exe explorer.exe PID 2372 wrote to memory of 3780 2372 EXCEL.EXE regsvr32.exe PID 2372 wrote to memory of 3780 2372 EXCEL.EXE regsvr32.exe PID 3780 wrote to memory of 2536 3780 regsvr32.exe regsvr32.exe PID 3780 wrote to memory of 2536 3780 regsvr32.exe regsvr32.exe PID 3780 wrote to memory of 2536 3780 regsvr32.exe regsvr32.exe PID 2536 wrote to memory of 756 2536 regsvr32.exe explorer.exe PID 2536 wrote to memory of 756 2536 regsvr32.exe explorer.exe PID 2536 wrote to memory of 756 2536 regsvr32.exe explorer.exe PID 2536 wrote to memory of 756 2536 regsvr32.exe explorer.exe PID 2536 wrote to memory of 756 2536 regsvr32.exe explorer.exe PID 3296 wrote to memory of 1608 3296 regsvr32.exe regsvr32.exe PID 3296 wrote to memory of 1608 3296 regsvr32.exe regsvr32.exe PID 3296 wrote to memory of 1608 3296 regsvr32.exe regsvr32.exe PID 1608 wrote to memory of 3364 1608 regsvr32.exe explorer.exe PID 1608 wrote to memory of 3364 1608 regsvr32.exe explorer.exe PID 1608 wrote to memory of 3364 1608 regsvr32.exe explorer.exe PID 1608 wrote to memory of 3364 1608 regsvr32.exe explorer.exe PID 1608 wrote to memory of 3364 1608 regsvr32.exe explorer.exe PID 3364 wrote to memory of 2168 3364 explorer.exe reg.exe PID 3364 wrote to memory of 2168 3364 explorer.exe reg.exe PID 3364 wrote to memory of 2164 3364 explorer.exe reg.exe PID 3364 wrote to memory of 2164 3364 explorer.exe reg.exe PID 1424 wrote to memory of 3968 1424 explorer.exe whoami.exe PID 1424 wrote to memory of 3968 1424 explorer.exe whoami.exe PID 1424 wrote to memory of 3968 1424 explorer.exe whoami.exe PID 1424 wrote to memory of 756 1424 explorer.exe cmd.exe PID 1424 wrote to memory of 756 1424 explorer.exe cmd.exe PID 1424 wrote to memory of 756 1424 explorer.exe cmd.exe PID 1424 wrote to memory of 3584 1424 explorer.exe arp.exe PID 1424 wrote to memory of 3584 1424 explorer.exe arp.exe PID 1424 wrote to memory of 3584 1424 explorer.exe arp.exe PID 1424 wrote to memory of 3708 1424 explorer.exe ipconfig.exe PID 1424 wrote to memory of 3708 1424 explorer.exe ipconfig.exe PID 1424 wrote to memory of 3708 1424 explorer.exe ipconfig.exe PID 1424 wrote to memory of 2292 1424 explorer.exe net.exe PID 1424 wrote to memory of 2292 1424 explorer.exe net.exe PID 1424 wrote to memory of 2292 1424 explorer.exe net.exe PID 1424 wrote to memory of 3676 1424 explorer.exe nslookup.exe PID 1424 wrote to memory of 3676 1424 explorer.exe nslookup.exe PID 1424 wrote to memory of 3676 1424 explorer.exe nslookup.exe PID 1424 wrote to memory of 2704 1424 explorer.exe net.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\CompensationClaim-68254946-09282021.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\regsvr32.exeregsvr32 -silent ..\Drezd.red2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-silent ..\Drezd.red3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn mwagzodx /tr "regsvr32.exe -s \"C:\Users\Admin\Drezd.red\"" /SC ONCE /Z /ST 15:38 /ET 15:505⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\whoami.exewhoami /all5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd /c set5⤵
-
C:\Windows\SysWOW64\arp.exearp -a5⤵
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /all5⤵
- Gathers network information
-
C:\Windows\SysWOW64\net.exenet view /all5⤵
- Discovers systems in the same network
-
C:\Windows\SysWOW64\nslookup.exenslookup -querytype=ALL -timeout=10 _ldap._tcp.dc._msdcs.WORKGROUP5⤵
-
C:\Windows\SysWOW64\net.exenet share5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 share6⤵
-
C:\Windows\SysWOW64\route.exeroute print5⤵
-
C:\Windows\SysWOW64\netstat.exenetstat -nao5⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\net.exenet localgroup5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup6⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Roaming\Microsoft\Uuevtyplk\swrymdusazuoyv.dll"5⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe6⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe7⤵
-
C:\Windows\SYSTEM32\regsvr32.exeregsvr32 -silent ..\Drezd1.red2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-silent ..\Drezd1.red3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe4⤵
-
C:\Windows\SYSTEM32\regsvr32.exeregsvr32 -silent ..\Drezd2.red2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-silent ..\Drezd2.red3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe4⤵
-
\??\c:\windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\Drezd.red"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\Drezd.red"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Hpevmea" /d "0"4⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Uuevtyplk" /d "0"4⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Uuevtyplk\swrymdusazuoyv.dllMD5
d03e6eac1f6dcf00ecb1fd9c2080ff13
SHA1cae499ad31950dff1d1c9817aa026425c320fc33
SHA256e93616d580fb6bfb523ccb2bf089963f015dce0c3b8f3523de10c2197590a8b1
SHA512a7ee705eae939fde90dce984a31af34895fe35582d378e5631462bf7b8f3acd0d9c19e288257a492a20de8664f6db44268f0d735c6c4e83359554b8215015771
-
C:\Users\Admin\Drezd.redMD5
cab2dca20d849da1b20e6a61bb2d26fb
SHA1f87743a59933fb36f029ea50e5e57593a876f726
SHA2569be5c4141a62a610ed53125d238ecfd3139a521bfbdde9f8f3c2cd3eab6180e8
SHA512cfe0c6f4b27641a73660b68a8a6d1686b7ea450492de23f6a4dd9758f43fe4ee4e8120f4677e59062e7e5400a5c958f6c74175ea3ac83ec5f0abf95585608dee
-
C:\Users\Admin\Drezd.redMD5
cab2dca20d849da1b20e6a61bb2d26fb
SHA1f87743a59933fb36f029ea50e5e57593a876f726
SHA2569be5c4141a62a610ed53125d238ecfd3139a521bfbdde9f8f3c2cd3eab6180e8
SHA512cfe0c6f4b27641a73660b68a8a6d1686b7ea450492de23f6a4dd9758f43fe4ee4e8120f4677e59062e7e5400a5c958f6c74175ea3ac83ec5f0abf95585608dee
-
C:\Users\Admin\Drezd1.redMD5
cab2dca20d849da1b20e6a61bb2d26fb
SHA1f87743a59933fb36f029ea50e5e57593a876f726
SHA2569be5c4141a62a610ed53125d238ecfd3139a521bfbdde9f8f3c2cd3eab6180e8
SHA512cfe0c6f4b27641a73660b68a8a6d1686b7ea450492de23f6a4dd9758f43fe4ee4e8120f4677e59062e7e5400a5c958f6c74175ea3ac83ec5f0abf95585608dee
-
C:\Users\Admin\Drezd2.redMD5
cab2dca20d849da1b20e6a61bb2d26fb
SHA1f87743a59933fb36f029ea50e5e57593a876f726
SHA2569be5c4141a62a610ed53125d238ecfd3139a521bfbdde9f8f3c2cd3eab6180e8
SHA512cfe0c6f4b27641a73660b68a8a6d1686b7ea450492de23f6a4dd9758f43fe4ee4e8120f4677e59062e7e5400a5c958f6c74175ea3ac83ec5f0abf95585608dee
-
\??\PIPE\wkssvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Users\Admin\AppData\Roaming\Microsoft\Uuevtyplk\swrymdusazuoyv.dllMD5
d03e6eac1f6dcf00ecb1fd9c2080ff13
SHA1cae499ad31950dff1d1c9817aa026425c320fc33
SHA256e93616d580fb6bfb523ccb2bf089963f015dce0c3b8f3523de10c2197590a8b1
SHA512a7ee705eae939fde90dce984a31af34895fe35582d378e5631462bf7b8f3acd0d9c19e288257a492a20de8664f6db44268f0d735c6c4e83359554b8215015771
-
\Users\Admin\Drezd.redMD5
cab2dca20d849da1b20e6a61bb2d26fb
SHA1f87743a59933fb36f029ea50e5e57593a876f726
SHA2569be5c4141a62a610ed53125d238ecfd3139a521bfbdde9f8f3c2cd3eab6180e8
SHA512cfe0c6f4b27641a73660b68a8a6d1686b7ea450492de23f6a4dd9758f43fe4ee4e8120f4677e59062e7e5400a5c958f6c74175ea3ac83ec5f0abf95585608dee
-
\Users\Admin\Drezd.redMD5
cab2dca20d849da1b20e6a61bb2d26fb
SHA1f87743a59933fb36f029ea50e5e57593a876f726
SHA2569be5c4141a62a610ed53125d238ecfd3139a521bfbdde9f8f3c2cd3eab6180e8
SHA512cfe0c6f4b27641a73660b68a8a6d1686b7ea450492de23f6a4dd9758f43fe4ee4e8120f4677e59062e7e5400a5c958f6c74175ea3ac83ec5f0abf95585608dee
-
\Users\Admin\Drezd1.redMD5
cab2dca20d849da1b20e6a61bb2d26fb
SHA1f87743a59933fb36f029ea50e5e57593a876f726
SHA2569be5c4141a62a610ed53125d238ecfd3139a521bfbdde9f8f3c2cd3eab6180e8
SHA512cfe0c6f4b27641a73660b68a8a6d1686b7ea450492de23f6a4dd9758f43fe4ee4e8120f4677e59062e7e5400a5c958f6c74175ea3ac83ec5f0abf95585608dee
-
\Users\Admin\Drezd2.redMD5
cab2dca20d849da1b20e6a61bb2d26fb
SHA1f87743a59933fb36f029ea50e5e57593a876f726
SHA2569be5c4141a62a610ed53125d238ecfd3139a521bfbdde9f8f3c2cd3eab6180e8
SHA512cfe0c6f4b27641a73660b68a8a6d1686b7ea450492de23f6a4dd9758f43fe4ee4e8120f4677e59062e7e5400a5c958f6c74175ea3ac83ec5f0abf95585608dee
-
memory/420-359-0x00000000033B0000-0x00000000033B1000-memory.dmpFilesize
4KB
-
memory/420-357-0x0000000002DD0000-0x0000000002DF1000-memory.dmpFilesize
132KB
-
memory/420-356-0x0000000000000000-mapping.dmp
-
memory/436-344-0x0000000000000000-mapping.dmp
-
memory/756-313-0x0000000000150000-0x0000000000171000-memory.dmpFilesize
132KB
-
memory/756-307-0x0000000000000000-mapping.dmp
-
memory/756-337-0x0000000000000000-mapping.dmp
-
memory/1196-287-0x0000000000000000-mapping.dmp
-
memory/1424-293-0x0000000003280000-0x0000000003281000-memory.dmpFilesize
4KB
-
memory/1424-286-0x0000000000000000-mapping.dmp
-
memory/1424-294-0x0000000002D90000-0x0000000002DB1000-memory.dmpFilesize
132KB
-
memory/1468-298-0x0000000000000000-mapping.dmp
-
memory/1468-303-0x0000000002D90000-0x0000000002DB1000-memory.dmpFilesize
132KB
-
memory/1528-345-0x0000000000000000-mapping.dmp
-
memory/1608-318-0x0000000000000000-mapping.dmp
-
memory/1608-323-0x00000000032C0000-0x000000000340A000-memory.dmpFilesize
1.3MB
-
memory/1608-321-0x00000000733F0000-0x00000000734C2000-memory.dmpFilesize
840KB
-
memory/1688-291-0x0000000000000000-mapping.dmp
-
memory/1964-296-0x00000000733F0000-0x00000000734C2000-memory.dmpFilesize
840KB
-
memory/1964-295-0x00000000733F0000-0x0000000073411000-memory.dmpFilesize
132KB
-
memory/1964-289-0x0000000000000000-mapping.dmp
-
memory/1964-297-0x0000000002810000-0x00000000028BE000-memory.dmpFilesize
696KB
-
memory/2164-347-0x0000000000000000-mapping.dmp
-
memory/2164-332-0x0000000000000000-mapping.dmp
-
memory/2168-346-0x0000000000000000-mapping.dmp
-
memory/2168-331-0x0000000000000000-mapping.dmp
-
memory/2292-340-0x0000000000000000-mapping.dmp
-
memory/2372-120-0x00007FFB8C970000-0x00007FFB8C980000-memory.dmpFilesize
64KB
-
memory/2372-118-0x00007FFB8C970000-0x00007FFB8C980000-memory.dmpFilesize
64KB
-
memory/2372-119-0x00007FFB8C970000-0x00007FFB8C980000-memory.dmpFilesize
64KB
-
memory/2372-117-0x00007FFB8C970000-0x00007FFB8C980000-memory.dmpFilesize
64KB
-
memory/2372-123-0x00007FFBAD180000-0x00007FFBAE26E000-memory.dmpFilesize
16.9MB
-
memory/2372-116-0x00007FFB8C970000-0x00007FFB8C980000-memory.dmpFilesize
64KB
-
memory/2372-115-0x00007FF690A00000-0x00007FF693FB6000-memory.dmpFilesize
53.7MB
-
memory/2372-124-0x00000291BC730000-0x00000291BE625000-memory.dmpFilesize
31.0MB
-
memory/2372-274-0x00000291CC1B0000-0x00000291CC1B4000-memory.dmpFilesize
16KB
-
memory/2536-305-0x00000000733F0000-0x00000000734C2000-memory.dmpFilesize
840KB
-
memory/2536-301-0x0000000000000000-mapping.dmp
-
memory/2536-306-0x0000000002AF0000-0x0000000002AF1000-memory.dmpFilesize
4KB
-
memory/2704-342-0x0000000000000000-mapping.dmp
-
memory/3364-335-0x00000000006E0000-0x0000000000701000-memory.dmpFilesize
132KB
-
memory/3364-330-0x0000000000000000-mapping.dmp
-
memory/3536-354-0x0000000005300000-0x0000000005321000-memory.dmpFilesize
132KB
-
memory/3536-353-0x00000000034E0000-0x00000000034E1000-memory.dmpFilesize
4KB
-
memory/3536-355-0x0000000005350000-0x0000000005371000-memory.dmpFilesize
132KB
-
memory/3536-350-0x0000000000000000-mapping.dmp
-
memory/3584-338-0x0000000000000000-mapping.dmp
-
memory/3676-341-0x0000000000000000-mapping.dmp
-
memory/3708-339-0x0000000000000000-mapping.dmp
-
memory/3780-299-0x0000000000000000-mapping.dmp
-
memory/3788-283-0x0000000073FB0000-0x0000000073FD1000-memory.dmpFilesize
132KB
-
memory/3788-285-0x0000000002E40000-0x0000000002EEE000-memory.dmpFilesize
696KB
-
memory/3788-284-0x0000000073FB0000-0x0000000074082000-memory.dmpFilesize
840KB
-
memory/3788-281-0x0000000000000000-mapping.dmp
-
memory/3916-360-0x0000000000000000-mapping.dmp
-
memory/3916-362-0x0000000002C90000-0x0000000002D1C000-memory.dmpFilesize
560KB
-
memory/3916-361-0x0000000000370000-0x0000000000391000-memory.dmpFilesize
132KB
-
memory/3936-343-0x0000000000000000-mapping.dmp
-
memory/3968-336-0x0000000000000000-mapping.dmp
-
memory/3992-279-0x0000000000000000-mapping.dmp