Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
28-10-2021 15:37
Static task
static1
Behavioral task
behavioral1
Sample
KVD 25180299.xlsx
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
KVD 25180299.xlsx
Resource
win10-en-20211014
General
-
Target
KVD 25180299.xlsx
-
Size
488KB
-
MD5
3ea4d7fa257736ee5499186011e4de92
-
SHA1
7c3796317e67bd5c361123e1ab88fb0a7802ede9
-
SHA256
27b4c7536a4044b0f7a08db959059c15883e080c56f81bf2c985c377cb3ebbad
-
SHA512
b1adcc108f65b618ada3774998c6115548bd7c8ef362306ff8b549f313e47d5294803863f1f5351dd4b01414cf86a948b3075e6b0da80860f3bbd70e898b1f3c
Malware Config
Extracted
xloader
2.5
dnz9
http://www.chunhejingming.com/dnz9/
rafiqueandbrothers.com
goldenpeacock.asia
youngliving1.com
rtxoffers.xyz
southernrustllc.com
becomemoreamerican.com
chrapania.com
babedad.com
dttrransportjunkremoval.com
contemporarytaste.net
windfly.online
eatnewlyone.xyz
funeralarorg.com
candlecandlesshop.com
emexcaraccessories.com
nutmegmassage.com
053152277.xyz
blissnewsletter.com
cyys23.com
dayral-review.com
bricnbroc.fr
gratishoortoestel.info
notablybravo.net
ktnrape.xyz
moussevision.com
limitlessbettings.com
redilegal.com
wafflebank.com
virginiapaddlers.com
bra866.com
xuelingjun.com
beestrongcbd.com
distinctivemotoring.com
criticalnet.net
desideals.today
foxxloop.com
ioumal.com
bestofwestpalmbeach.info
kuechenmann.com
averysanswers.com
adellbiofoods.com
a10pm.com
boatloadoflemonade.com
marialuisaantonelli.com
sypcontadores.com
francesca-daniel.com
nobis.care
cryptohelpassists.xyz
mvesga.com
solgoewaste.com
mammalians.com
benchmarklandscapingfl.com
crown-crossline.space
comicmonk.com
helpfromjames.com
com103940689794.icu
lifeofchickens.com
thehuntnewsletter.com
tipplesmith.net
sandman.network
rancrontrading.com
thewitchandcauldron.com
onwardtransportation.com
tweeddixie.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1940-66-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1940-67-0x000000000041D550-mapping.dmp xloader behavioral1/memory/1940-73-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1896-79-0x0000000000080000-0x00000000000A9000-memory.dmp xloader -
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 4 1236 EQNEDT32.EXE -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
vbc.exevbc.exepid process 1300 vbc.exe 1940 vbc.exe -
Loads dropped DLL 4 IoCs
Processes:
EQNEDT32.EXEvbc.exepid process 1236 EQNEDT32.EXE 1236 EQNEDT32.EXE 1236 EQNEDT32.EXE 1300 vbc.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 4 IoCs
Processes:
vbc.exevbc.execmd.exedescription pid process target process PID 1300 set thread context of 1940 1300 vbc.exe vbc.exe PID 1940 set thread context of 1404 1940 vbc.exe Explorer.EXE PID 1940 set thread context of 1404 1940 vbc.exe Explorer.EXE PID 1896 set thread context of 1404 1896 cmd.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NSIS installer 12 IoCs
Processes:
resource yara_rule \Users\Public\vbc.exe nsis_installer_1 \Users\Public\vbc.exe nsis_installer_2 \Users\Public\vbc.exe nsis_installer_1 \Users\Public\vbc.exe nsis_installer_2 \Users\Public\vbc.exe nsis_installer_1 \Users\Public\vbc.exe nsis_installer_2 C:\Users\Public\vbc.exe nsis_installer_1 C:\Users\Public\vbc.exe nsis_installer_2 C:\Users\Public\vbc.exe nsis_installer_1 C:\Users\Public\vbc.exe nsis_installer_2 C:\Users\Public\vbc.exe nsis_installer_1 C:\Users\Public\vbc.exe nsis_installer_2 -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE -
Modifies registry class 64 IoCs
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597} EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 700 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 27 IoCs
Processes:
vbc.execmd.exepid process 1940 vbc.exe 1940 vbc.exe 1940 vbc.exe 1896 cmd.exe 1896 cmd.exe 1896 cmd.exe 1896 cmd.exe 1896 cmd.exe 1896 cmd.exe 1896 cmd.exe 1896 cmd.exe 1896 cmd.exe 1896 cmd.exe 1896 cmd.exe 1896 cmd.exe 1896 cmd.exe 1896 cmd.exe 1896 cmd.exe 1896 cmd.exe 1896 cmd.exe 1896 cmd.exe 1896 cmd.exe 1896 cmd.exe 1896 cmd.exe 1896 cmd.exe 1896 cmd.exe 1896 cmd.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1404 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
vbc.execmd.exepid process 1940 vbc.exe 1940 vbc.exe 1940 vbc.exe 1940 vbc.exe 1896 cmd.exe 1896 cmd.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
vbc.exeExplorer.EXEcmd.exedescription pid process Token: SeDebugPrivilege 1940 vbc.exe Token: SeShutdownPrivilege 1404 Explorer.EXE Token: SeShutdownPrivilege 1404 Explorer.EXE Token: SeShutdownPrivilege 1404 Explorer.EXE Token: SeDebugPrivilege 1896 cmd.exe Token: SeShutdownPrivilege 1404 Explorer.EXE Token: SeShutdownPrivilege 1404 Explorer.EXE Token: SeShutdownPrivilege 1404 Explorer.EXE -
Suspicious use of FindShellTrayWindow 6 IoCs
Processes:
Explorer.EXEpid process 1404 Explorer.EXE 1404 Explorer.EXE 1404 Explorer.EXE 1404 Explorer.EXE 1404 Explorer.EXE 1404 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1404 Explorer.EXE 1404 Explorer.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 700 EXCEL.EXE 700 EXCEL.EXE 700 EXCEL.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
EQNEDT32.EXEvbc.exeExplorer.EXEcmd.exedescription pid process target process PID 1236 wrote to memory of 1300 1236 EQNEDT32.EXE vbc.exe PID 1236 wrote to memory of 1300 1236 EQNEDT32.EXE vbc.exe PID 1236 wrote to memory of 1300 1236 EQNEDT32.EXE vbc.exe PID 1236 wrote to memory of 1300 1236 EQNEDT32.EXE vbc.exe PID 1300 wrote to memory of 1940 1300 vbc.exe vbc.exe PID 1300 wrote to memory of 1940 1300 vbc.exe vbc.exe PID 1300 wrote to memory of 1940 1300 vbc.exe vbc.exe PID 1300 wrote to memory of 1940 1300 vbc.exe vbc.exe PID 1300 wrote to memory of 1940 1300 vbc.exe vbc.exe PID 1300 wrote to memory of 1940 1300 vbc.exe vbc.exe PID 1300 wrote to memory of 1940 1300 vbc.exe vbc.exe PID 1404 wrote to memory of 1896 1404 Explorer.EXE cmd.exe PID 1404 wrote to memory of 1896 1404 Explorer.EXE cmd.exe PID 1404 wrote to memory of 1896 1404 Explorer.EXE cmd.exe PID 1404 wrote to memory of 1896 1404 Explorer.EXE cmd.exe PID 1896 wrote to memory of 2012 1896 cmd.exe cmd.exe PID 1896 wrote to memory of 2012 1896 cmd.exe cmd.exe PID 1896 wrote to memory of 2012 1896 cmd.exe cmd.exe PID 1896 wrote to memory of 2012 1896 cmd.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\KVD 25180299.xlsx"2⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Public\vbc.exe"3⤵
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\vbc.exeMD5
783069f0cc8045c5e8eb255b5c38d6bc
SHA1fe24a3db15f687966921655306a951b2bc3fbe08
SHA256791b0ab463a7916c4a4873b898972b026b3eb66fe599775916cce39831951cab
SHA5125aa9bf8c6b2f9ec5faff322a8965e9911aeba18e0a8cab5a952a5737e5c20bd7a60cb3e7b65a3eb1701181363b6d02b0c539ff8ad4d29f420018c58cc5b7df15
-
C:\Users\Public\vbc.exeMD5
783069f0cc8045c5e8eb255b5c38d6bc
SHA1fe24a3db15f687966921655306a951b2bc3fbe08
SHA256791b0ab463a7916c4a4873b898972b026b3eb66fe599775916cce39831951cab
SHA5125aa9bf8c6b2f9ec5faff322a8965e9911aeba18e0a8cab5a952a5737e5c20bd7a60cb3e7b65a3eb1701181363b6d02b0c539ff8ad4d29f420018c58cc5b7df15
-
C:\Users\Public\vbc.exeMD5
783069f0cc8045c5e8eb255b5c38d6bc
SHA1fe24a3db15f687966921655306a951b2bc3fbe08
SHA256791b0ab463a7916c4a4873b898972b026b3eb66fe599775916cce39831951cab
SHA5125aa9bf8c6b2f9ec5faff322a8965e9911aeba18e0a8cab5a952a5737e5c20bd7a60cb3e7b65a3eb1701181363b6d02b0c539ff8ad4d29f420018c58cc5b7df15
-
\Users\Admin\AppData\Local\Temp\nsiFF75.tmp\mtrpiyvfxf.dllMD5
c4aecad1a9cf60556a851574f792fd4e
SHA10a207eddc044071ab82caf1e96fe1eb5a6723db2
SHA256d91985c2bce220a0d58952fb12772608cfb10868e6b8621989209ce3fec96689
SHA5129866ff13bbd66d37963a20f662bf7f0056d4d737f6a151f11cb1780146d42389f071949f9b408df473458b485e826021a4ca1aa50b942c4650baa22715b097dd
-
\Users\Public\vbc.exeMD5
783069f0cc8045c5e8eb255b5c38d6bc
SHA1fe24a3db15f687966921655306a951b2bc3fbe08
SHA256791b0ab463a7916c4a4873b898972b026b3eb66fe599775916cce39831951cab
SHA5125aa9bf8c6b2f9ec5faff322a8965e9911aeba18e0a8cab5a952a5737e5c20bd7a60cb3e7b65a3eb1701181363b6d02b0c539ff8ad4d29f420018c58cc5b7df15
-
\Users\Public\vbc.exeMD5
783069f0cc8045c5e8eb255b5c38d6bc
SHA1fe24a3db15f687966921655306a951b2bc3fbe08
SHA256791b0ab463a7916c4a4873b898972b026b3eb66fe599775916cce39831951cab
SHA5125aa9bf8c6b2f9ec5faff322a8965e9911aeba18e0a8cab5a952a5737e5c20bd7a60cb3e7b65a3eb1701181363b6d02b0c539ff8ad4d29f420018c58cc5b7df15
-
\Users\Public\vbc.exeMD5
783069f0cc8045c5e8eb255b5c38d6bc
SHA1fe24a3db15f687966921655306a951b2bc3fbe08
SHA256791b0ab463a7916c4a4873b898972b026b3eb66fe599775916cce39831951cab
SHA5125aa9bf8c6b2f9ec5faff322a8965e9911aeba18e0a8cab5a952a5737e5c20bd7a60cb3e7b65a3eb1701181363b6d02b0c539ff8ad4d29f420018c58cc5b7df15
-
memory/700-55-0x00000000712B1000-0x00000000712B3000-memory.dmpFilesize
8KB
-
memory/700-54-0x000000002FE81000-0x000000002FE84000-memory.dmpFilesize
12KB
-
memory/700-56-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/700-83-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1236-57-0x00000000751D1000-0x00000000751D3000-memory.dmpFilesize
8KB
-
memory/1300-61-0x0000000000000000-mapping.dmp
-
memory/1404-82-0x0000000006050000-0x0000000006118000-memory.dmpFilesize
800KB
-
memory/1404-72-0x0000000006A60000-0x0000000006B66000-memory.dmpFilesize
1.0MB
-
memory/1404-75-0x00000000070E0000-0x0000000007285000-memory.dmpFilesize
1.6MB
-
memory/1896-78-0x000000004AB30000-0x000000004AB7C000-memory.dmpFilesize
304KB
-
memory/1896-80-0x0000000001FC0000-0x00000000022C3000-memory.dmpFilesize
3.0MB
-
memory/1896-81-0x0000000001EB0000-0x0000000001F40000-memory.dmpFilesize
576KB
-
memory/1896-79-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1896-76-0x0000000000000000-mapping.dmp
-
memory/1940-70-0x0000000000970000-0x0000000000C73000-memory.dmpFilesize
3.0MB
-
memory/1940-74-0x0000000000560000-0x0000000000571000-memory.dmpFilesize
68KB
-
memory/1940-73-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1940-71-0x00000000003D0000-0x00000000003E1000-memory.dmpFilesize
68KB
-
memory/1940-67-0x000000000041D550-mapping.dmp
-
memory/1940-66-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2012-77-0x0000000000000000-mapping.dmp