Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
21-10-2021 06:14
Static task
static1
Behavioral task
behavioral1
Sample
JEP Sports Player Rating.xlsx
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
JEP Sports Player Rating.xlsx
Resource
win10-en-20211014
General
-
Target
JEP Sports Player Rating.xlsx
-
Size
366KB
-
MD5
4fb3e59606677f24794e9d10668cebeb
-
SHA1
8f8e1f1c84523cbc96d934c4ba30f910772f4754
-
SHA256
7f1234fef1cd3abb7a451afc69c458b03fd125e1a553b5af679bc79297986be5
-
SHA512
2c5cd7e0747caf6f7e93323da826fd515fdcf2b29f7f3aa01c16818d5a238089b84547b7eced1b20dc868d79d442f9c1f7fb675c992a2b6e004bb8fcf2d9662f
Malware Config
Extracted
xloader
2.5
sb6n
http://www.best5amazon.com/sb6n/
bogosamba.com
inmobiliariapuertalavilla.com
nopressurewellness.com
hairshopamity.com
epicmoments360.com
tutorgpa.com
fucibou.xyz
135631.com
portraydashcam.com
raqsarabia.com
okantis.net
vongquaykimcuongfreefire.online
prodom.online
5537sbishop.info
lisakenneyinc.com
fivetime.xyz
borzv.com
joungla.com
mas-urbano.com
sjczyw.com
kanesia.com
cursovendasafiliagram.website
lumledstore.com
id-434563.site
tinkerform.com
chainedorchange.com
147149cale.com
windmillbusiness.com
moccocity.com
linkinsense.net
asportrans.com
texasmotorcycletransport.com
unviajeinsospechado.com
rishaande.tech
happylifecompanies.com
thewtot.com
homeyhousy.com
schoolx.space
gr-pcs.com
bedrocksolution.net
investorsbamk.com
rewoodlovro.quest
scratchforce.com
roosteco.com
zacharyparkerporward5.com
itranslate.club
mastessrhalco.com
jytyxyc.xyz
theelegantflamestore.com
grausalvarez.com
riveroakdevelopment.com
intervalagency.com
yugenft.com
6672pk.com
euphoricpucci.com
sedlmayer.gmbh
caricomrealestate.online
herseymagazamda.com
kefirusa.com
royalclnglegacy.com
toptanalcimalzemeleri.com
recbi56ni.com
transformdom.net
writersmight.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1048-68-0x0000000000000000-mapping.dmp xloader behavioral1/memory/1048-72-0x0000000072480000-0x00000000724A9000-memory.dmp xloader behavioral1/memory/1072-86-0x0000000000080000-0x00000000000A9000-memory.dmp xloader -
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 4 268 EQNEDT32.EXE -
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
vbc.exepid process 852 vbc.exe -
Loads dropped DLL 2 IoCs
Processes:
EQNEDT32.EXEpid process 268 EQNEDT32.EXE 268 EQNEDT32.EXE -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\Run\Qhscwo = "C:\\Users\\Public\\owcshQ.url" vbc.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
DpiScaling.execolorcpl.exedescription pid process target process PID 1048 set thread context of 1364 1048 DpiScaling.exe Explorer.EXE PID 1072 set thread context of 1364 1072 colorcpl.exe Explorer.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
EXCEL.EXEdescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE -
Modifies registry class 64 IoCs
Processes:
EXCEL.EXEdescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE -
Modifies registry key 1 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1080 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
DpiScaling.execolorcpl.exepid process 1048 DpiScaling.exe 1048 DpiScaling.exe 1072 colorcpl.exe 1072 colorcpl.exe 1072 colorcpl.exe 1072 colorcpl.exe 1072 colorcpl.exe 1072 colorcpl.exe 1072 colorcpl.exe 1072 colorcpl.exe 1072 colorcpl.exe 1072 colorcpl.exe 1072 colorcpl.exe 1072 colorcpl.exe 1072 colorcpl.exe 1072 colorcpl.exe 1072 colorcpl.exe 1072 colorcpl.exe 1072 colorcpl.exe 1072 colorcpl.exe 1072 colorcpl.exe 1072 colorcpl.exe 1072 colorcpl.exe 1072 colorcpl.exe 1072 colorcpl.exe 1072 colorcpl.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1364 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
DpiScaling.execolorcpl.exepid process 1048 DpiScaling.exe 1048 DpiScaling.exe 1048 DpiScaling.exe 1072 colorcpl.exe 1072 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
DpiScaling.execolorcpl.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1048 DpiScaling.exe Token: SeDebugPrivilege 1072 colorcpl.exe Token: SeShutdownPrivilege 1364 Explorer.EXE Token: SeShutdownPrivilege 1364 Explorer.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1080 EXCEL.EXE 1080 EXCEL.EXE 1080 EXCEL.EXE -
Suspicious use of WriteProcessMemory 47 IoCs
Processes:
EQNEDT32.EXEvbc.execmd.execmd.exeExplorer.EXEcolorcpl.execmd.exedescription pid process target process PID 268 wrote to memory of 852 268 EQNEDT32.EXE vbc.exe PID 268 wrote to memory of 852 268 EQNEDT32.EXE vbc.exe PID 268 wrote to memory of 852 268 EQNEDT32.EXE vbc.exe PID 268 wrote to memory of 852 268 EQNEDT32.EXE vbc.exe PID 852 wrote to memory of 1048 852 vbc.exe DpiScaling.exe PID 852 wrote to memory of 1048 852 vbc.exe DpiScaling.exe PID 852 wrote to memory of 1048 852 vbc.exe DpiScaling.exe PID 852 wrote to memory of 1048 852 vbc.exe DpiScaling.exe PID 852 wrote to memory of 1048 852 vbc.exe DpiScaling.exe PID 852 wrote to memory of 1048 852 vbc.exe DpiScaling.exe PID 852 wrote to memory of 1048 852 vbc.exe DpiScaling.exe PID 852 wrote to memory of 1900 852 vbc.exe cmd.exe PID 852 wrote to memory of 1900 852 vbc.exe cmd.exe PID 852 wrote to memory of 1900 852 vbc.exe cmd.exe PID 852 wrote to memory of 1900 852 vbc.exe cmd.exe PID 1900 wrote to memory of 1168 1900 cmd.exe cmd.exe PID 1900 wrote to memory of 1168 1900 cmd.exe cmd.exe PID 1900 wrote to memory of 1168 1900 cmd.exe cmd.exe PID 1900 wrote to memory of 1168 1900 cmd.exe cmd.exe PID 1168 wrote to memory of 1584 1168 cmd.exe reg.exe PID 1168 wrote to memory of 1584 1168 cmd.exe reg.exe PID 1168 wrote to memory of 1584 1168 cmd.exe reg.exe PID 1168 wrote to memory of 1584 1168 cmd.exe reg.exe PID 1168 wrote to memory of 1576 1168 cmd.exe reg.exe PID 1168 wrote to memory of 1576 1168 cmd.exe reg.exe PID 1168 wrote to memory of 1576 1168 cmd.exe reg.exe PID 1168 wrote to memory of 1576 1168 cmd.exe reg.exe PID 1168 wrote to memory of 948 1168 cmd.exe schtasks.exe PID 1168 wrote to memory of 948 1168 cmd.exe schtasks.exe PID 1168 wrote to memory of 948 1168 cmd.exe schtasks.exe PID 1168 wrote to memory of 948 1168 cmd.exe schtasks.exe PID 1364 wrote to memory of 1072 1364 Explorer.EXE colorcpl.exe PID 1364 wrote to memory of 1072 1364 Explorer.EXE colorcpl.exe PID 1364 wrote to memory of 1072 1364 Explorer.EXE colorcpl.exe PID 1364 wrote to memory of 1072 1364 Explorer.EXE colorcpl.exe PID 1072 wrote to memory of 524 1072 colorcpl.exe cmd.exe PID 1072 wrote to memory of 524 1072 colorcpl.exe cmd.exe PID 1072 wrote to memory of 524 1072 colorcpl.exe cmd.exe PID 1072 wrote to memory of 524 1072 colorcpl.exe cmd.exe PID 852 wrote to memory of 1564 852 vbc.exe cmd.exe PID 852 wrote to memory of 1564 852 vbc.exe cmd.exe PID 852 wrote to memory of 1564 852 vbc.exe cmd.exe PID 852 wrote to memory of 1564 852 vbc.exe cmd.exe PID 1564 wrote to memory of 364 1564 cmd.exe reg.exe PID 1564 wrote to memory of 364 1564 cmd.exe reg.exe PID 1564 wrote to memory of 364 1564 cmd.exe reg.exe PID 1564 wrote to memory of 364 1564 cmd.exe reg.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\JEP Sports Player Rating.xlsx"2⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\DpiScaling.exe"3⤵
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\DpiScaling.exeC:\Windows\System32\DpiScaling.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Public\Trast.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg delete hkcu\Environment /v windir /f5⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "5⤵
- Modifies registry key
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Public\nest.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg delete hkcu\Environment /v windir /f4⤵
- Modifies registry key
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\Trast.batMD5
4068c9f69fcd8a171c67f81d4a952a54
SHA14d2536a8c28cdcc17465e20d6693fb9e8e713b36
SHA25624222300c78180b50ed1f8361ba63cb27316ec994c1c9079708a51b4a1a9d810
SHA512a64f9319acc51fffd0491c74dcd9c9084c2783b82f95727e4bfe387a8528c6dcf68f11418e88f1e133d115daf907549c86dd7ad866b2a7938add5225fbb2811d
-
C:\Users\Public\UKO.batMD5
eaf8d967454c3bbddbf2e05a421411f8
SHA16170880409b24de75c2dc3d56a506fbff7f6622c
SHA256f35f2658455a2e40f151549a7d6465a836c33fa9109e67623916f889849eac56
SHA512fe5be5c673e99f70c93019d01abb0a29dd2ecf25b2d895190ff551f020c28e7d8f99f65007f440f0f76c5bcac343b2a179a94d190c938ea3b9e1197890a412e9
-
C:\Users\Public\nest.batMD5
8ada51400b7915de2124baaf75e3414c
SHA11a7b9db12184ab7fd7fce1c383f9670a00adb081
SHA25645aa3957c29865260a78f03eef18ae9aebdbf7bea751ecc88be4a799f2bb46c7
SHA5129afc138157a4565294ca49942579cdb6f5d8084e56f9354738de62b585f4c0fa3e7f2cbc9541827f2084e3ff36c46eed29b46f5dd2444062ffcd05c599992e68
-
C:\Users\Public\vbc.exeMD5
51cd4ea4c20552f51824b13af3a93360
SHA11f85673268160d356cc66056e18e721646a51034
SHA256891ff9447dec210b5897080666b8281d7387206c14dba7587465e16bd2efa117
SHA512add0bc6bec599694cdd9c19101edf0b66a914aa4198ed9f10d23e4c14b8bf2708c992917326974007c59c4e6e5c49063c0e1ade25556cdc19ae9dc1a8c79fbcf
-
C:\Users\Public\vbc.exeMD5
51cd4ea4c20552f51824b13af3a93360
SHA11f85673268160d356cc66056e18e721646a51034
SHA256891ff9447dec210b5897080666b8281d7387206c14dba7587465e16bd2efa117
SHA512add0bc6bec599694cdd9c19101edf0b66a914aa4198ed9f10d23e4c14b8bf2708c992917326974007c59c4e6e5c49063c0e1ade25556cdc19ae9dc1a8c79fbcf
-
\Users\Public\vbc.exeMD5
51cd4ea4c20552f51824b13af3a93360
SHA11f85673268160d356cc66056e18e721646a51034
SHA256891ff9447dec210b5897080666b8281d7387206c14dba7587465e16bd2efa117
SHA512add0bc6bec599694cdd9c19101edf0b66a914aa4198ed9f10d23e4c14b8bf2708c992917326974007c59c4e6e5c49063c0e1ade25556cdc19ae9dc1a8c79fbcf
-
\Users\Public\vbc.exeMD5
51cd4ea4c20552f51824b13af3a93360
SHA11f85673268160d356cc66056e18e721646a51034
SHA256891ff9447dec210b5897080666b8281d7387206c14dba7587465e16bd2efa117
SHA512add0bc6bec599694cdd9c19101edf0b66a914aa4198ed9f10d23e4c14b8bf2708c992917326974007c59c4e6e5c49063c0e1ade25556cdc19ae9dc1a8c79fbcf
-
memory/268-56-0x0000000075FC1000-0x0000000075FC3000-memory.dmpFilesize
8KB
-
memory/364-92-0x0000000000000000-mapping.dmp
-
memory/524-87-0x0000000000000000-mapping.dmp
-
memory/852-59-0x0000000000000000-mapping.dmp
-
memory/852-62-0x0000000000251000-0x0000000000265000-memory.dmpFilesize
80KB
-
memory/852-61-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/948-78-0x0000000000000000-mapping.dmp
-
memory/1048-65-0x0000000072480000-0x00000000724A9000-memory.dmpFilesize
164KB
-
memory/1048-66-0x00000000000A0000-0x00000000000A1000-memory.dmpFilesize
4KB
-
memory/1048-68-0x0000000000000000-mapping.dmp
-
memory/1048-72-0x0000000072480000-0x00000000724A9000-memory.dmpFilesize
164KB
-
memory/1048-71-0x00000000000B0000-0x00000000000B1000-memory.dmpFilesize
4KB
-
memory/1048-81-0x0000000000230000-0x0000000000241000-memory.dmpFilesize
68KB
-
memory/1048-80-0x0000000001F00000-0x0000000002203000-memory.dmpFilesize
3.0MB
-
memory/1072-85-0x00000000004E0000-0x00000000004F8000-memory.dmpFilesize
96KB
-
memory/1072-89-0x00000000003C0000-0x0000000000450000-memory.dmpFilesize
576KB
-
memory/1072-88-0x0000000001EF0000-0x00000000021F3000-memory.dmpFilesize
3.0MB
-
memory/1072-86-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1072-83-0x0000000000000000-mapping.dmp
-
memory/1080-53-0x000000002FB91000-0x000000002FB94000-memory.dmpFilesize
12KB
-
memory/1080-55-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1080-54-0x00000000717B1000-0x00000000717B3000-memory.dmpFilesize
8KB
-
memory/1080-94-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1168-74-0x0000000000000000-mapping.dmp
-
memory/1364-82-0x0000000004900000-0x00000000049B2000-memory.dmpFilesize
712KB
-
memory/1364-93-0x0000000007190000-0x0000000007315000-memory.dmpFilesize
1.5MB
-
memory/1564-90-0x0000000000000000-mapping.dmp
-
memory/1576-77-0x0000000000000000-mapping.dmp
-
memory/1584-76-0x0000000000000000-mapping.dmp
-
memory/1900-70-0x0000000000000000-mapping.dmp