Analysis

  • max time kernel
    119s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-en-20211014
  • submitted
    29-10-2021 08:06

General

  • Target

    008.xlsx

  • Size

    369KB

  • MD5

    c9d8f6b863cf269cc0d1ac8ac810b0b0

  • SHA1

    4ef9b0fb96dc429586c8e2e29be2ead7a6a3434f

  • SHA256

    5823cb05aaaf03a93a7d4a03c4207163701e79bf872d716525d8e8d2c15acc2b

  • SHA512

    8b019b0044bd5a58eb1fccb97230f1e4c65d3a164b6a0bfce3543bd882334562a3163b5123cbde963772e0b1e68d58ac23baf2eb19a4ef0e6c7dd2dd9d742ae1

Score
10/10

Malware Config

Signatures

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\008.xlsx
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:944
  • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
    1⤵
    • Blocklisted process makes network request
    • Loads dropped DLL
    • Launches Equation Editor
    • Suspicious use of WriteProcessMemory
    PID:976
    • C:\Users\Public\vbc.exe
      "C:\Users\Public\vbc.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: GetForegroundWindowSpam
      PID:1060

Network

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Public\vbc.exe
    MD5

    374fb48a959a96ce92ae0e4346763293

    SHA1

    ce9cba115e6efff3bf100335f04da05ffff82b9d

    SHA256

    f2d2638afb528c7476c9ee8e83ddb20e686b0b05f53f2f966fd9eb962427f8aa

    SHA512

    63b2858711ff1a219fe969d563307e9a708be165f9fcedfc2c1c48da270775d033ac915d361a8ac34a98d60904e0abf364b7ccaf27e9fc5a8993fe88c4bd26a3

  • \Users\Public\vbc.exe
    MD5

    374fb48a959a96ce92ae0e4346763293

    SHA1

    ce9cba115e6efff3bf100335f04da05ffff82b9d

    SHA256

    f2d2638afb528c7476c9ee8e83ddb20e686b0b05f53f2f966fd9eb962427f8aa

    SHA512

    63b2858711ff1a219fe969d563307e9a708be165f9fcedfc2c1c48da270775d033ac915d361a8ac34a98d60904e0abf364b7ccaf27e9fc5a8993fe88c4bd26a3

  • \Users\Public\vbc.exe
    MD5

    374fb48a959a96ce92ae0e4346763293

    SHA1

    ce9cba115e6efff3bf100335f04da05ffff82b9d

    SHA256

    f2d2638afb528c7476c9ee8e83ddb20e686b0b05f53f2f966fd9eb962427f8aa

    SHA512

    63b2858711ff1a219fe969d563307e9a708be165f9fcedfc2c1c48da270775d033ac915d361a8ac34a98d60904e0abf364b7ccaf27e9fc5a8993fe88c4bd26a3

  • memory/944-55-0x000000002F341000-0x000000002F344000-memory.dmp
    Filesize

    12KB

  • memory/944-56-0x0000000071B61000-0x0000000071B63000-memory.dmp
    Filesize

    8KB

  • memory/944-57-0x000000005FFF0000-0x0000000060000000-memory.dmp
    Filesize

    64KB

  • memory/944-64-0x000000005FFF0000-0x0000000060000000-memory.dmp
    Filesize

    64KB

  • memory/976-58-0x0000000075BA1000-0x0000000075BA3000-memory.dmp
    Filesize

    8KB

  • memory/1060-61-0x0000000000000000-mapping.dmp