Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
02-11-2021 08:40
Static task
static1
Behavioral task
behavioral1
Sample
New_Order.xlsx
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
New_Order.xlsx
Resource
win10-en-20210920
General
-
Target
New_Order.xlsx
-
Size
169KB
-
MD5
924b9433629fa62bb788d53bd408bf34
-
SHA1
9c3232c6e59aefdf2426d55b1752664166bb01eb
-
SHA256
b0c314459603fd3d02158655704e3415482e7d816c62f7373f5136f32f17ec5c
-
SHA512
2f485c147ec00c54dd2d08542a743b736e78fedfd5eabf5e9b7a9bd7d937dfedb8fefc974bcbdbca6aad22eb761449bedc11b6cda66c0a8b12232c05ca856392
Malware Config
Extracted
xloader
2.5
rqan
http://www.cardboutiqueapp.com/rqan/
panda.wiki
gailkannamassage.com
ungravitystudio.com
coraggiomusicschool.com
51walkerstreetrippleside.com
infemax.store
mapara-foundation.net
elitespeedwaxs.com
manateeprint.com
thelocksmithtradeshow.com
phoenix-out-of-ashes.com
marionkgregory.store
abasketofwords.com
century21nokta.com
anthonyaarnold.com
forevermyanmar.com
ramashi.com
uniquecarbonbrush.com
packecco.com
appelnacrtl.quest
mayo-group.com
healthychefla.com
chuhaitalk.com
promoapp12.com
sergomosta.com
missuniversepr.com
onfinan.com
moyue27.com
miaocharge.com
hubmedia.digital
sarasota-pressurewashing.com
deliciousrecipe.xyz
rosalia-pilates-angers.com
qqsmt09.com
comercialjyv.com
ismarthings.com
b8ceex.com
reviewbyornex.online
familylovmix.com
wurzelwerk-sk.com
buratacoin.com
delocdinh.com
paraspikakasino.com
buyinsurance24.com
d1storesa.com
apollonfitnessvrn.club
tokofebri.store
cambabez.xyz
pointcon.net
digitalcoursepreneur.com
15dgj.xyz
mg-garage.com
claggs.com
yuezhong66.com
uvowtae.xyz
puutuisossa.quest
glitchpunks.art
haferssippe.quest
ucwykl.biz
finlandtwo.xyz
efterpisart.com
usbankofamerican.com
bamubusinesssolutions.com
lakshhomesbalram.info
Signatures
-
Xloader Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/904-72-0x0000000000000000-mapping.dmp xloader behavioral1/memory/904-76-0x0000000072480000-0x00000000724A9000-memory.dmp xloader behavioral1/memory/904-80-0x0000000072480000-0x00000000724A9000-memory.dmp xloader behavioral1/memory/1612-86-0x0000000000080000-0x00000000000A9000-memory.dmp xloader -
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 4 568 EQNEDT32.EXE -
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
vbc.exepid process 2032 vbc.exe -
Loads dropped DLL 4 IoCs
Processes:
EQNEDT32.EXEpid process 568 EQNEDT32.EXE 568 EQNEDT32.EXE 568 EQNEDT32.EXE 568 EQNEDT32.EXE -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Windows\CurrentVersion\Run\Esjciodw = "C:\\Users\\Public\\Libraries\\\\wdoicjsE.url" vbc.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
DpiScaling.exeraserver.exedescription pid process target process PID 904 set thread context of 1268 904 DpiScaling.exe Explorer.EXE PID 904 set thread context of 1268 904 DpiScaling.exe Explorer.EXE PID 1612 set thread context of 1268 1612 raserver.exe Explorer.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND EXCEL.EXE -
Modifies registry class 64 IoCs
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14 EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 520 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
DpiScaling.exeraserver.exepid process 904 DpiScaling.exe 904 DpiScaling.exe 904 DpiScaling.exe 1612 raserver.exe 1612 raserver.exe 1612 raserver.exe 1612 raserver.exe 1612 raserver.exe 1612 raserver.exe 1612 raserver.exe 1612 raserver.exe 1612 raserver.exe 1612 raserver.exe 1612 raserver.exe 1612 raserver.exe 1612 raserver.exe 1612 raserver.exe 1612 raserver.exe 1612 raserver.exe 1612 raserver.exe 1612 raserver.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1268 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
DpiScaling.exeraserver.exepid process 904 DpiScaling.exe 904 DpiScaling.exe 904 DpiScaling.exe 904 DpiScaling.exe 1612 raserver.exe 1612 raserver.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
DpiScaling.exeraserver.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 904 DpiScaling.exe Token: SeDebugPrivilege 1612 raserver.exe Token: SeShutdownPrivilege 1268 Explorer.EXE Token: SeShutdownPrivilege 1268 Explorer.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 520 EXCEL.EXE 520 EXCEL.EXE 520 EXCEL.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
EQNEDT32.EXEvbc.exeExplorer.EXEdescription pid process target process PID 568 wrote to memory of 2032 568 EQNEDT32.EXE vbc.exe PID 568 wrote to memory of 2032 568 EQNEDT32.EXE vbc.exe PID 568 wrote to memory of 2032 568 EQNEDT32.EXE vbc.exe PID 568 wrote to memory of 2032 568 EQNEDT32.EXE vbc.exe PID 2032 wrote to memory of 904 2032 vbc.exe DpiScaling.exe PID 2032 wrote to memory of 904 2032 vbc.exe DpiScaling.exe PID 2032 wrote to memory of 904 2032 vbc.exe DpiScaling.exe PID 2032 wrote to memory of 904 2032 vbc.exe DpiScaling.exe PID 2032 wrote to memory of 904 2032 vbc.exe DpiScaling.exe PID 2032 wrote to memory of 904 2032 vbc.exe DpiScaling.exe PID 2032 wrote to memory of 904 2032 vbc.exe DpiScaling.exe PID 1268 wrote to memory of 1612 1268 Explorer.EXE raserver.exe PID 1268 wrote to memory of 1612 1268 Explorer.EXE raserver.exe PID 1268 wrote to memory of 1612 1268 Explorer.EXE raserver.exe PID 1268 wrote to memory of 1612 1268 Explorer.EXE raserver.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\New_Order.xlsx2⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\DpiScaling.exeC:\Windows\System32\DpiScaling.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\vbc.exeMD5
594effa8099b0150fc62239293f7510f
SHA187444f70ca409daa829a6b2ef5c405c96e4bd2c3
SHA2562cabf83aab4b0138620bee4d622ab0b9c5774f5520422fa362257716cf3260bc
SHA512d35f5b098a031eff7a25cc20afff9e0bfa6147bd0a6e3c8b873052682decbd556208e6d5b3b6652cd9e8ca9335f2c8bd74facb2e1e640e605084b468794538a7
-
C:\Users\Public\vbc.exeMD5
594effa8099b0150fc62239293f7510f
SHA187444f70ca409daa829a6b2ef5c405c96e4bd2c3
SHA2562cabf83aab4b0138620bee4d622ab0b9c5774f5520422fa362257716cf3260bc
SHA512d35f5b098a031eff7a25cc20afff9e0bfa6147bd0a6e3c8b873052682decbd556208e6d5b3b6652cd9e8ca9335f2c8bd74facb2e1e640e605084b468794538a7
-
\Users\Public\vbc.exeMD5
594effa8099b0150fc62239293f7510f
SHA187444f70ca409daa829a6b2ef5c405c96e4bd2c3
SHA2562cabf83aab4b0138620bee4d622ab0b9c5774f5520422fa362257716cf3260bc
SHA512d35f5b098a031eff7a25cc20afff9e0bfa6147bd0a6e3c8b873052682decbd556208e6d5b3b6652cd9e8ca9335f2c8bd74facb2e1e640e605084b468794538a7
-
\Users\Public\vbc.exeMD5
594effa8099b0150fc62239293f7510f
SHA187444f70ca409daa829a6b2ef5c405c96e4bd2c3
SHA2562cabf83aab4b0138620bee4d622ab0b9c5774f5520422fa362257716cf3260bc
SHA512d35f5b098a031eff7a25cc20afff9e0bfa6147bd0a6e3c8b873052682decbd556208e6d5b3b6652cd9e8ca9335f2c8bd74facb2e1e640e605084b468794538a7
-
\Users\Public\vbc.exeMD5
594effa8099b0150fc62239293f7510f
SHA187444f70ca409daa829a6b2ef5c405c96e4bd2c3
SHA2562cabf83aab4b0138620bee4d622ab0b9c5774f5520422fa362257716cf3260bc
SHA512d35f5b098a031eff7a25cc20afff9e0bfa6147bd0a6e3c8b873052682decbd556208e6d5b3b6652cd9e8ca9335f2c8bd74facb2e1e640e605084b468794538a7
-
\Users\Public\vbc.exeMD5
594effa8099b0150fc62239293f7510f
SHA187444f70ca409daa829a6b2ef5c405c96e4bd2c3
SHA2562cabf83aab4b0138620bee4d622ab0b9c5774f5520422fa362257716cf3260bc
SHA512d35f5b098a031eff7a25cc20afff9e0bfa6147bd0a6e3c8b873052682decbd556208e6d5b3b6652cd9e8ca9335f2c8bd74facb2e1e640e605084b468794538a7
-
memory/520-56-0x00000000715B1000-0x00000000715B3000-memory.dmpFilesize
8KB
-
memory/520-57-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/520-90-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/520-55-0x000000002FF21000-0x000000002FF24000-memory.dmpFilesize
12KB
-
memory/568-58-0x00000000764D1000-0x00000000764D3000-memory.dmpFilesize
8KB
-
memory/904-70-0x0000000000080000-0x0000000000081000-memory.dmpFilesize
4KB
-
memory/904-80-0x0000000072480000-0x00000000724A9000-memory.dmpFilesize
164KB
-
memory/904-69-0x0000000072480000-0x00000000724A9000-memory.dmpFilesize
164KB
-
memory/904-81-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/904-72-0x0000000000000000-mapping.dmp
-
memory/904-76-0x0000000072480000-0x00000000724A9000-memory.dmpFilesize
164KB
-
memory/904-75-0x00000000000D0000-0x00000000000D1000-memory.dmpFilesize
4KB
-
memory/904-78-0x00000000002A0000-0x00000000002B1000-memory.dmpFilesize
68KB
-
memory/904-77-0x0000000002090000-0x0000000002393000-memory.dmpFilesize
3.0MB
-
memory/1268-79-0x00000000071E0000-0x000000000734A000-memory.dmpFilesize
1.4MB
-
memory/1268-82-0x0000000003C60000-0x0000000003D62000-memory.dmpFilesize
1.0MB
-
memory/1268-89-0x0000000008EB0000-0x0000000009034000-memory.dmpFilesize
1.5MB
-
memory/1612-83-0x0000000000000000-mapping.dmp
-
memory/1612-85-0x0000000000130000-0x000000000014C000-memory.dmpFilesize
112KB
-
memory/1612-86-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1612-87-0x0000000001EC0000-0x00000000021C3000-memory.dmpFilesize
3.0MB
-
memory/1612-88-0x0000000001D30000-0x0000000001DC0000-memory.dmpFilesize
576KB
-
memory/2032-67-0x0000000000251000-0x0000000000265000-memory.dmpFilesize
80KB
-
memory/2032-66-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/2032-63-0x0000000000000000-mapping.dmp