93e3236b047c6ed504bb5d8fc19aefd24509fb3146e3b5cfb75d62da0815cd31

Analysis

max time kernel
124s
max time network
120s
platform
windows7_x64
resource
win7-en-20211014
submitted
29-10-2021 11:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7.xlsx
Size

540KB
MD5

9b50011e2e440ce076593d979f5d88b2
SHA1

2483b34c8abc0f8366c7113a713c52029699c4d2
SHA256

93e3236b047c6ed504bb5d8fc19aefd24509fb3146e3b5cfb75d62da0815cd31
SHA512

4e52521b7c5576fee55a5258e4265ec3bdab60f4e03336cfef21fbffef32bbdcb8feafe016601e648eee61af0d8b538bc92fbb66ee2e0c6b90773c38f1fa1999

Score

10^/10

suricata

Malware Config

Signatures

suricata: ET MALWARE Possible MalDoc Payload Download Nov 11 2014
suricata: ET MALWARE Possible MalDoc Payload Download Nov 11 2014
suricata
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata
Blocklisted process makes network request 1 IoCs

Processes:

EQNEDT32.EXE

flow pid process

4 1312 EQNEDT32.EXE
Downloads MZ/PE file
Executes dropped EXE 1 IoCs

Processes:

vbc.exe

pid process

1476 vbc.exe

flow	pid	process
4	1312	EQNEDT32.EXE

pid	process
1476	vbc.exe

Loads dropped DLL 9 IoCs

Processes:

EQNEDT32.EXEWerFault.exe

pid	process
1312	EQNEDT32.EXE
1312	EQNEDT32.EXE
1312	EQNEDT32.EXE
1312	EQNEDT32.EXE
1836	WerFault.exe
1836	WerFault.exe
1836	WerFault.exe
1836	WerFault.exe
1836	WerFault.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1836 1476 WerFault.exe vbc.exe
Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

EXCEL.EXE

description ioc process

Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
exploit

Exploitation for Client Execution
T1203

Processes:

EQNEDT32.EXE

pid process

1312 EQNEDT32.EXE

pid	pid_target	process	target process
1836	1476	WerFault.exe	vbc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

EXCEL.EXE

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	EXCEL.EXE

Modifies registry class 64 IoCs

Processes:

EXCEL.EXE

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit"	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\""	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

676 EXCEL.EXE
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1836 WerFault.exe
1836 WerFault.exe
1836 WerFault.exe
1836 WerFault.exe
1836 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1836 WerFault.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

vbc.exeWerFault.exe

description pid process

Token: SeDebugPrivilege 1476 vbc.exe
Token: SeDebugPrivilege 1836 WerFault.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

EXCEL.EXE

pid process

676 EXCEL.EXE
676 EXCEL.EXE
676 EXCEL.EXE

pid	process
676	EXCEL.EXE

pid	process
1836	WerFault.exe
1836	WerFault.exe
1836	WerFault.exe
1836	WerFault.exe
1836	WerFault.exe

pid	process
1836	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1476	vbc.exe
Token: SeDebugPrivilege	1836	WerFault.exe

pid	process
676	EXCEL.EXE
676	EXCEL.EXE
676	EXCEL.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

EQNEDT32.EXEvbc.exe

description	pid	process	target process
PID 1312 wrote to memory of 1476	1312	EQNEDT32.EXE	vbc.exe
PID 1312 wrote to memory of 1476	1312	EQNEDT32.EXE	vbc.exe
PID 1312 wrote to memory of 1476	1312	EQNEDT32.EXE	vbc.exe
PID 1312 wrote to memory of 1476	1312	EQNEDT32.EXE	vbc.exe
PID 1476 wrote to memory of 1836	1476	vbc.exe	WerFault.exe
PID 1476 wrote to memory of 1836	1476	vbc.exe	WerFault.exe
PID 1476 wrote to memory of 1836	1476	vbc.exe	WerFault.exe
PID 1476 wrote to memory of 1836	1476	vbc.exe	WerFault.exe

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\7.xlsx
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:676

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:1312

C:\Users\Public\vbc.exe
"C:\Users\Public\vbc.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1476 -s 688
3⤵
- Loads dropped DLL
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1836

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

T1064

Exploitation for Client Execution

T1203

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\vbc.exe
MD5
41c1dd1d0d6399e9eb4284edddf8d854

SHA1
69e38a7a4928b34919ec793b48b9bc2d86267b23

SHA256
28991c7adcfa289bb7bfb4e560d9cfc68f7f29726adbd1b24260be24fda696b0

SHA512
67e3f441651c5576b7caedc91528deb8ae67366dd842d6971b08d9bc97520395eac545f0461f93197afad60ca07b3db102f183ffc0ed6b997b4d2fd462591489

Download Submit
C:\Users\Public\vbc.exe
MD5
41c1dd1d0d6399e9eb4284edddf8d854

SHA1
69e38a7a4928b34919ec793b48b9bc2d86267b23

SHA256
28991c7adcfa289bb7bfb4e560d9cfc68f7f29726adbd1b24260be24fda696b0

SHA512
67e3f441651c5576b7caedc91528deb8ae67366dd842d6971b08d9bc97520395eac545f0461f93197afad60ca07b3db102f183ffc0ed6b997b4d2fd462591489

Download Submit
\Users\Public\vbc.exe
MD5
41c1dd1d0d6399e9eb4284edddf8d854

SHA1
69e38a7a4928b34919ec793b48b9bc2d86267b23

SHA256
28991c7adcfa289bb7bfb4e560d9cfc68f7f29726adbd1b24260be24fda696b0

SHA512
67e3f441651c5576b7caedc91528deb8ae67366dd842d6971b08d9bc97520395eac545f0461f93197afad60ca07b3db102f183ffc0ed6b997b4d2fd462591489

Download Submit
\Users\Public\vbc.exe
MD5
41c1dd1d0d6399e9eb4284edddf8d854

SHA1
69e38a7a4928b34919ec793b48b9bc2d86267b23

SHA256
28991c7adcfa289bb7bfb4e560d9cfc68f7f29726adbd1b24260be24fda696b0

SHA512
67e3f441651c5576b7caedc91528deb8ae67366dd842d6971b08d9bc97520395eac545f0461f93197afad60ca07b3db102f183ffc0ed6b997b4d2fd462591489

Download Submit
\Users\Public\vbc.exe
MD5
41c1dd1d0d6399e9eb4284edddf8d854

SHA1
69e38a7a4928b34919ec793b48b9bc2d86267b23

SHA256
28991c7adcfa289bb7bfb4e560d9cfc68f7f29726adbd1b24260be24fda696b0

SHA512
67e3f441651c5576b7caedc91528deb8ae67366dd842d6971b08d9bc97520395eac545f0461f93197afad60ca07b3db102f183ffc0ed6b997b4d2fd462591489

Download Submit
\Users\Public\vbc.exe
MD5
41c1dd1d0d6399e9eb4284edddf8d854

SHA1
69e38a7a4928b34919ec793b48b9bc2d86267b23

SHA256
28991c7adcfa289bb7bfb4e560d9cfc68f7f29726adbd1b24260be24fda696b0

SHA512
67e3f441651c5576b7caedc91528deb8ae67366dd842d6971b08d9bc97520395eac545f0461f93197afad60ca07b3db102f183ffc0ed6b997b4d2fd462591489

Download Submit
\Users\Public\vbc.exe
MD5
41c1dd1d0d6399e9eb4284edddf8d854

SHA1
69e38a7a4928b34919ec793b48b9bc2d86267b23

SHA256
28991c7adcfa289bb7bfb4e560d9cfc68f7f29726adbd1b24260be24fda696b0

SHA512
67e3f441651c5576b7caedc91528deb8ae67366dd842d6971b08d9bc97520395eac545f0461f93197afad60ca07b3db102f183ffc0ed6b997b4d2fd462591489

Download Submit
\Users\Public\vbc.exe
MD5
41c1dd1d0d6399e9eb4284edddf8d854

SHA1
69e38a7a4928b34919ec793b48b9bc2d86267b23

SHA256
28991c7adcfa289bb7bfb4e560d9cfc68f7f29726adbd1b24260be24fda696b0

SHA512
67e3f441651c5576b7caedc91528deb8ae67366dd842d6971b08d9bc97520395eac545f0461f93197afad60ca07b3db102f183ffc0ed6b997b4d2fd462591489

Download Submit
\Users\Public\vbc.exe
MD5
41c1dd1d0d6399e9eb4284edddf8d854

SHA1
69e38a7a4928b34919ec793b48b9bc2d86267b23

SHA256
28991c7adcfa289bb7bfb4e560d9cfc68f7f29726adbd1b24260be24fda696b0

SHA512
67e3f441651c5576b7caedc91528deb8ae67366dd842d6971b08d9bc97520395eac545f0461f93197afad60ca07b3db102f183ffc0ed6b997b4d2fd462591489

Download Submit
\Users\Public\vbc.exe
MD5
41c1dd1d0d6399e9eb4284edddf8d854

SHA1
69e38a7a4928b34919ec793b48b9bc2d86267b23

SHA256
28991c7adcfa289bb7bfb4e560d9cfc68f7f29726adbd1b24260be24fda696b0

SHA512
67e3f441651c5576b7caedc91528deb8ae67366dd842d6971b08d9bc97520395eac545f0461f93197afad60ca07b3db102f183ffc0ed6b997b4d2fd462591489

Download Submit
\Users\Public\vbc.exe
MD5
41c1dd1d0d6399e9eb4284edddf8d854

SHA1
69e38a7a4928b34919ec793b48b9bc2d86267b23

SHA256
28991c7adcfa289bb7bfb4e560d9cfc68f7f29726adbd1b24260be24fda696b0

SHA512
67e3f441651c5576b7caedc91528deb8ae67366dd842d6971b08d9bc97520395eac545f0461f93197afad60ca07b3db102f183ffc0ed6b997b4d2fd462591489

Download Submit
memory/676-77-0x00000000052C3000-0x00000000052C5000-memory.dmp

Filesize
8KB

Download
memory/676-78-0x00000000052C5000-0x00000000052C7000-memory.dmp

Filesize
8KB

Download
memory/676-79-0x00000000052C7000-0x00000000052CA000-memory.dmp

Filesize
12KB

Download
memory/676-76-0x00000000052C0000-0x00000000052C3000-memory.dmp

Filesize
12KB

Download
memory/676-55-0x000000002F5B1000-0x000000002F5B4000-memory.dmp

Filesize
12KB

Download
memory/676-56-0x0000000071821000-0x0000000071823000-memory.dmp

Filesize
8KB

Download
memory/676-57-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1312-58-0x00000000762D1000-0x00000000762D3000-memory.dmp

Filesize
8KB

Download
memory/1476-66-0x00000000011E0000-0x00000000011E1000-memory.dmp

Filesize
4KB

Download
memory/1476-69-0x00000000011A0000-0x00000000011A1000-memory.dmp

Filesize
4KB

Download
memory/1476-70-0x00000000005A0000-0x00000000005A3000-memory.dmp

Filesize
12KB

Download
memory/1476-63-0x0000000000000000-mapping.dmp

Download
memory/1836-71-0x0000000000000000-mapping.dmp

Download
memory/1836-81-0x0000000000410000-0x0000000000411000-memory.dmp

Filesize
4KB

Download