Analysis
-
max time kernel
149s -
max time network
174s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
28-10-2021 15:20
Static task
static1
Behavioral task
behavioral1
Sample
KVD 25180299.xlsx
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
KVD 25180299.xlsx
Resource
win10-en-20211014
General
-
Target
KVD 25180299.xlsx
-
Size
488KB
-
MD5
3ea4d7fa257736ee5499186011e4de92
-
SHA1
7c3796317e67bd5c361123e1ab88fb0a7802ede9
-
SHA256
27b4c7536a4044b0f7a08db959059c15883e080c56f81bf2c985c377cb3ebbad
-
SHA512
b1adcc108f65b618ada3774998c6115548bd7c8ef362306ff8b549f313e47d5294803863f1f5351dd4b01414cf86a948b3075e6b0da80860f3bbd70e898b1f3c
Malware Config
Extracted
xloader
2.5
dnz9
http://www.chunhejingming.com/dnz9/
rafiqueandbrothers.com
goldenpeacock.asia
youngliving1.com
rtxoffers.xyz
southernrustllc.com
becomemoreamerican.com
chrapania.com
babedad.com
dttrransportjunkremoval.com
contemporarytaste.net
windfly.online
eatnewlyone.xyz
funeralarorg.com
candlecandlesshop.com
emexcaraccessories.com
nutmegmassage.com
053152277.xyz
blissnewsletter.com
cyys23.com
dayral-review.com
bricnbroc.fr
gratishoortoestel.info
notablybravo.net
ktnrape.xyz
moussevision.com
limitlessbettings.com
redilegal.com
wafflebank.com
virginiapaddlers.com
bra866.com
xuelingjun.com
beestrongcbd.com
distinctivemotoring.com
criticalnet.net
desideals.today
foxxloop.com
ioumal.com
bestofwestpalmbeach.info
kuechenmann.com
averysanswers.com
adellbiofoods.com
a10pm.com
boatloadoflemonade.com
marialuisaantonelli.com
sypcontadores.com
francesca-daniel.com
nobis.care
cryptohelpassists.xyz
mvesga.com
solgoewaste.com
mammalians.com
benchmarklandscapingfl.com
crown-crossline.space
comicmonk.com
helpfromjames.com
com103940689794.icu
lifeofchickens.com
thehuntnewsletter.com
tipplesmith.net
sandman.network
rancrontrading.com
thewitchandcauldron.com
onwardtransportation.com
tweeddixie.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1100-66-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1100-67-0x000000000041D550-mapping.dmp xloader behavioral1/memory/852-77-0x00000000000D0000-0x00000000000F9000-memory.dmp xloader -
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 4 1732 EQNEDT32.EXE -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
vbc.exevbc.exepid process 1052 vbc.exe 1100 vbc.exe -
Loads dropped DLL 4 IoCs
Processes:
EQNEDT32.EXEvbc.exepid process 1732 EQNEDT32.EXE 1732 EQNEDT32.EXE 1732 EQNEDT32.EXE 1052 vbc.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
vbc.exevbc.exemsiexec.exedescription pid process target process PID 1052 set thread context of 1100 1052 vbc.exe vbc.exe PID 1100 set thread context of 1392 1100 vbc.exe Explorer.EXE PID 852 set thread context of 1392 852 msiexec.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NSIS installer 12 IoCs
Processes:
resource yara_rule \Users\Public\vbc.exe nsis_installer_1 \Users\Public\vbc.exe nsis_installer_2 \Users\Public\vbc.exe nsis_installer_1 \Users\Public\vbc.exe nsis_installer_2 \Users\Public\vbc.exe nsis_installer_1 \Users\Public\vbc.exe nsis_installer_2 C:\Users\Public\vbc.exe nsis_installer_1 C:\Users\Public\vbc.exe nsis_installer_2 C:\Users\Public\vbc.exe nsis_installer_1 C:\Users\Public\vbc.exe nsis_installer_2 C:\Users\Public\vbc.exe nsis_installer_1 C:\Users\Public\vbc.exe nsis_installer_2 -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
EXCEL.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command EXCEL.EXE -
Modifies registry class 64 IoCs
Processes:
EXCEL.EXEdescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597} EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1212 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 29 IoCs
Processes:
vbc.exemsiexec.exepid process 1100 vbc.exe 1100 vbc.exe 852 msiexec.exe 852 msiexec.exe 852 msiexec.exe 852 msiexec.exe 852 msiexec.exe 852 msiexec.exe 852 msiexec.exe 852 msiexec.exe 852 msiexec.exe 852 msiexec.exe 852 msiexec.exe 852 msiexec.exe 852 msiexec.exe 852 msiexec.exe 852 msiexec.exe 852 msiexec.exe 852 msiexec.exe 852 msiexec.exe 852 msiexec.exe 852 msiexec.exe 852 msiexec.exe 852 msiexec.exe 852 msiexec.exe 852 msiexec.exe 852 msiexec.exe 852 msiexec.exe 852 msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1392 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
vbc.exemsiexec.exepid process 1100 vbc.exe 1100 vbc.exe 1100 vbc.exe 852 msiexec.exe 852 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
vbc.exeExplorer.EXEmsiexec.exedescription pid process Token: SeDebugPrivilege 1100 vbc.exe Token: SeShutdownPrivilege 1392 Explorer.EXE Token: SeShutdownPrivilege 1392 Explorer.EXE Token: SeDebugPrivilege 852 msiexec.exe Token: SeShutdownPrivilege 1392 Explorer.EXE Token: SeShutdownPrivilege 1392 Explorer.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1212 EXCEL.EXE 1212 EXCEL.EXE 1212 EXCEL.EXE -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
EQNEDT32.EXEvbc.exeExplorer.EXEmsiexec.exedescription pid process target process PID 1732 wrote to memory of 1052 1732 EQNEDT32.EXE vbc.exe PID 1732 wrote to memory of 1052 1732 EQNEDT32.EXE vbc.exe PID 1732 wrote to memory of 1052 1732 EQNEDT32.EXE vbc.exe PID 1732 wrote to memory of 1052 1732 EQNEDT32.EXE vbc.exe PID 1052 wrote to memory of 1100 1052 vbc.exe vbc.exe PID 1052 wrote to memory of 1100 1052 vbc.exe vbc.exe PID 1052 wrote to memory of 1100 1052 vbc.exe vbc.exe PID 1052 wrote to memory of 1100 1052 vbc.exe vbc.exe PID 1052 wrote to memory of 1100 1052 vbc.exe vbc.exe PID 1052 wrote to memory of 1100 1052 vbc.exe vbc.exe PID 1052 wrote to memory of 1100 1052 vbc.exe vbc.exe PID 1392 wrote to memory of 852 1392 Explorer.EXE msiexec.exe PID 1392 wrote to memory of 852 1392 Explorer.EXE msiexec.exe PID 1392 wrote to memory of 852 1392 Explorer.EXE msiexec.exe PID 1392 wrote to memory of 852 1392 Explorer.EXE msiexec.exe PID 1392 wrote to memory of 852 1392 Explorer.EXE msiexec.exe PID 1392 wrote to memory of 852 1392 Explorer.EXE msiexec.exe PID 1392 wrote to memory of 852 1392 Explorer.EXE msiexec.exe PID 852 wrote to memory of 1960 852 msiexec.exe cmd.exe PID 852 wrote to memory of 1960 852 msiexec.exe cmd.exe PID 852 wrote to memory of 1960 852 msiexec.exe cmd.exe PID 852 wrote to memory of 1960 852 msiexec.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\KVD 25180299.xlsx"2⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Public\vbc.exe"3⤵
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\vbc.exeMD5
783069f0cc8045c5e8eb255b5c38d6bc
SHA1fe24a3db15f687966921655306a951b2bc3fbe08
SHA256791b0ab463a7916c4a4873b898972b026b3eb66fe599775916cce39831951cab
SHA5125aa9bf8c6b2f9ec5faff322a8965e9911aeba18e0a8cab5a952a5737e5c20bd7a60cb3e7b65a3eb1701181363b6d02b0c539ff8ad4d29f420018c58cc5b7df15
-
C:\Users\Public\vbc.exeMD5
783069f0cc8045c5e8eb255b5c38d6bc
SHA1fe24a3db15f687966921655306a951b2bc3fbe08
SHA256791b0ab463a7916c4a4873b898972b026b3eb66fe599775916cce39831951cab
SHA5125aa9bf8c6b2f9ec5faff322a8965e9911aeba18e0a8cab5a952a5737e5c20bd7a60cb3e7b65a3eb1701181363b6d02b0c539ff8ad4d29f420018c58cc5b7df15
-
C:\Users\Public\vbc.exeMD5
783069f0cc8045c5e8eb255b5c38d6bc
SHA1fe24a3db15f687966921655306a951b2bc3fbe08
SHA256791b0ab463a7916c4a4873b898972b026b3eb66fe599775916cce39831951cab
SHA5125aa9bf8c6b2f9ec5faff322a8965e9911aeba18e0a8cab5a952a5737e5c20bd7a60cb3e7b65a3eb1701181363b6d02b0c539ff8ad4d29f420018c58cc5b7df15
-
\Users\Admin\AppData\Local\Temp\nsi5CB1.tmp\mtrpiyvfxf.dllMD5
c4aecad1a9cf60556a851574f792fd4e
SHA10a207eddc044071ab82caf1e96fe1eb5a6723db2
SHA256d91985c2bce220a0d58952fb12772608cfb10868e6b8621989209ce3fec96689
SHA5129866ff13bbd66d37963a20f662bf7f0056d4d737f6a151f11cb1780146d42389f071949f9b408df473458b485e826021a4ca1aa50b942c4650baa22715b097dd
-
\Users\Public\vbc.exeMD5
783069f0cc8045c5e8eb255b5c38d6bc
SHA1fe24a3db15f687966921655306a951b2bc3fbe08
SHA256791b0ab463a7916c4a4873b898972b026b3eb66fe599775916cce39831951cab
SHA5125aa9bf8c6b2f9ec5faff322a8965e9911aeba18e0a8cab5a952a5737e5c20bd7a60cb3e7b65a3eb1701181363b6d02b0c539ff8ad4d29f420018c58cc5b7df15
-
\Users\Public\vbc.exeMD5
783069f0cc8045c5e8eb255b5c38d6bc
SHA1fe24a3db15f687966921655306a951b2bc3fbe08
SHA256791b0ab463a7916c4a4873b898972b026b3eb66fe599775916cce39831951cab
SHA5125aa9bf8c6b2f9ec5faff322a8965e9911aeba18e0a8cab5a952a5737e5c20bd7a60cb3e7b65a3eb1701181363b6d02b0c539ff8ad4d29f420018c58cc5b7df15
-
\Users\Public\vbc.exeMD5
783069f0cc8045c5e8eb255b5c38d6bc
SHA1fe24a3db15f687966921655306a951b2bc3fbe08
SHA256791b0ab463a7916c4a4873b898972b026b3eb66fe599775916cce39831951cab
SHA5125aa9bf8c6b2f9ec5faff322a8965e9911aeba18e0a8cab5a952a5737e5c20bd7a60cb3e7b65a3eb1701181363b6d02b0c539ff8ad4d29f420018c58cc5b7df15
-
memory/852-73-0x0000000000000000-mapping.dmp
-
memory/852-79-0x0000000001F50000-0x0000000001FE0000-memory.dmpFilesize
576KB
-
memory/852-76-0x00000000001F0000-0x0000000000204000-memory.dmpFilesize
80KB
-
memory/852-78-0x00000000020A0000-0x00000000023A3000-memory.dmpFilesize
3.0MB
-
memory/852-77-0x00000000000D0000-0x00000000000F9000-memory.dmpFilesize
164KB
-
memory/1052-61-0x0000000000000000-mapping.dmp
-
memory/1100-66-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1100-67-0x000000000041D550-mapping.dmp
-
memory/1100-70-0x0000000000740000-0x0000000000A43000-memory.dmpFilesize
3.0MB
-
memory/1100-71-0x0000000000480000-0x0000000000491000-memory.dmpFilesize
68KB
-
memory/1212-56-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1212-55-0x0000000071481000-0x0000000071483000-memory.dmpFilesize
8KB
-
memory/1212-54-0x000000002F361000-0x000000002F364000-memory.dmpFilesize
12KB
-
memory/1212-81-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1392-72-0x0000000006BB0000-0x0000000006CC4000-memory.dmpFilesize
1.1MB
-
memory/1392-80-0x0000000008CD0000-0x0000000008DAB000-memory.dmpFilesize
876KB
-
memory/1732-57-0x0000000076581000-0x0000000076583000-memory.dmpFilesize
8KB
-
memory/1960-75-0x0000000000000000-mapping.dmp