Analysis
-
max time kernel
152s -
max time network
153s -
platform
windows7_x64 -
resource
win7-en-20211104 -
submitted
25-11-2021 16:57
Static task
static1
Behavioral task
behavioral1
Sample
Payment Details.xlsx
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
Payment Details.xlsx
Resource
win10-en-20211014
General
-
Target
Payment Details.xlsx
-
Size
229KB
-
MD5
f49e322b837835ac60cad8c173ecff31
-
SHA1
c7cddfbf865b528d1bbbbe5c5f3974279cc8b6f5
-
SHA256
ff4e17d62ce9c71164879418e7942cecf8db37b16cb66adebc6c2570840f8524
-
SHA512
c5ce7feb4a44d0a3c0ba17c1104d599409c66c1a36e68f382df9048e18f02349c16cf4de21437f988e4779ce56847b9574dd83562dd1239bc88358922e2826b9
Malware Config
Extracted
formbook
4.1
g2fg
http://www.blancheshelley.xyz/g2fg/
snowcrash.website
pointman.us
newheartvalve.care
drandl.com
sandspringsramblers.com
programagubernamental.online
boja.us
mvrsnike.com
mentallyillmotherhood.com
facom.us
programagubernamental.store
izivente.com
roller-v.fr
amazonbioactives.com
metaverseapple.xyz
5gt-mobilevsverizon.com
gtwebsolutions.co
scottdunn.life
usdp.trade
pikmin.run
cardano-dogs.com
bf2hgfy.xyz
teslafoot.com
rubertquintana.com
wellsfargroewards.com
santel.us
couponatonline.com
theunitedhomeland.com
pmstnly.com
strlocal.com
shelleysmucker.com
youser.online
emansdesign.com
usnikeshoesbot.top
starfish.press
scotwork.us
metamorgana.com
onyxbx.net
rivas.company
firstcoastalfb.com
onpurposetraumainformedcare.com
celimot.xyz
jecunikepemej.rest
lenovolatenightit.com
unitedsterlingcompanyky.com
safety2venture.us
facebookismetanow.com
scottdunn.review
mentallyillmotherhood.com
firstincargo.com
vikavivi.com
investmenofpairs.club
nexans.cloud
farcloud.fr
ivermectinforhumans.quest
5gmalesdf.sbs
majenta.info
6vvvvvwmetam.top
metafirstclass.com
firstcoinnews.com
btcetffutures.online
funinfortmyers.com
mangoirslk.top
metaversebasicprivacy.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
Formbook Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1596-79-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1596-80-0x000000000041F160-mapping.dmp formbook behavioral1/memory/1192-82-0x00000000022A0000-0x0000000002EEA000-memory.dmp formbook behavioral1/memory/876-91-0x00000000000D0000-0x00000000000FF000-memory.dmp formbook -
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 4 1632 EQNEDT32.EXE -
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
vbc.exevbc.exevbc.exepid process 1544 vbc.exe 1352 vbc.exe 1596 vbc.exe -
Loads dropped DLL 4 IoCs
Processes:
EQNEDT32.EXEpid process 1632 EQNEDT32.EXE 1632 EQNEDT32.EXE 1632 EQNEDT32.EXE 1632 EQNEDT32.EXE -
Uses the VBS compiler for execution 1 TTPs
-
Drops file in System32 directory 1 IoCs
Processes:
powershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
vbc.exevbc.exewlanext.exedescription pid process target process PID 1544 set thread context of 1596 1544 vbc.exe vbc.exe PID 1596 set thread context of 1384 1596 vbc.exe Explorer.EXE PID 876 set thread context of 1384 876 wlanext.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE -
Modifies registry class 64 IoCs
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\"" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597} EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1444 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
vbc.exevbc.exepowershell.exewlanext.exepid process 1544 vbc.exe 1544 vbc.exe 1596 vbc.exe 1596 vbc.exe 1192 powershell.exe 876 wlanext.exe 876 wlanext.exe 876 wlanext.exe 876 wlanext.exe 876 wlanext.exe 876 wlanext.exe 876 wlanext.exe 876 wlanext.exe 876 wlanext.exe 876 wlanext.exe 876 wlanext.exe 876 wlanext.exe 876 wlanext.exe 876 wlanext.exe 876 wlanext.exe 876 wlanext.exe 876 wlanext.exe 876 wlanext.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1384 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
vbc.exewlanext.exepid process 1596 vbc.exe 1596 vbc.exe 1596 vbc.exe 876 wlanext.exe 876 wlanext.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
vbc.exevbc.exepowershell.exewlanext.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1544 vbc.exe Token: SeDebugPrivilege 1596 vbc.exe Token: SeDebugPrivilege 1192 powershell.exe Token: SeDebugPrivilege 876 wlanext.exe Token: SeShutdownPrivilege 1384 Explorer.EXE Token: SeShutdownPrivilege 1384 Explorer.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1444 EXCEL.EXE 1444 EXCEL.EXE 1444 EXCEL.EXE -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
EQNEDT32.EXEvbc.exeExplorer.EXEwlanext.exedescription pid process target process PID 1632 wrote to memory of 1544 1632 EQNEDT32.EXE vbc.exe PID 1632 wrote to memory of 1544 1632 EQNEDT32.EXE vbc.exe PID 1632 wrote to memory of 1544 1632 EQNEDT32.EXE vbc.exe PID 1632 wrote to memory of 1544 1632 EQNEDT32.EXE vbc.exe PID 1544 wrote to memory of 1192 1544 vbc.exe powershell.exe PID 1544 wrote to memory of 1192 1544 vbc.exe powershell.exe PID 1544 wrote to memory of 1192 1544 vbc.exe powershell.exe PID 1544 wrote to memory of 1192 1544 vbc.exe powershell.exe PID 1544 wrote to memory of 896 1544 vbc.exe schtasks.exe PID 1544 wrote to memory of 896 1544 vbc.exe schtasks.exe PID 1544 wrote to memory of 896 1544 vbc.exe schtasks.exe PID 1544 wrote to memory of 896 1544 vbc.exe schtasks.exe PID 1544 wrote to memory of 1352 1544 vbc.exe vbc.exe PID 1544 wrote to memory of 1352 1544 vbc.exe vbc.exe PID 1544 wrote to memory of 1352 1544 vbc.exe vbc.exe PID 1544 wrote to memory of 1352 1544 vbc.exe vbc.exe PID 1544 wrote to memory of 1596 1544 vbc.exe vbc.exe PID 1544 wrote to memory of 1596 1544 vbc.exe vbc.exe PID 1544 wrote to memory of 1596 1544 vbc.exe vbc.exe PID 1544 wrote to memory of 1596 1544 vbc.exe vbc.exe PID 1544 wrote to memory of 1596 1544 vbc.exe vbc.exe PID 1544 wrote to memory of 1596 1544 vbc.exe vbc.exe PID 1544 wrote to memory of 1596 1544 vbc.exe vbc.exe PID 1384 wrote to memory of 876 1384 Explorer.EXE wlanext.exe PID 1384 wrote to memory of 876 1384 Explorer.EXE wlanext.exe PID 1384 wrote to memory of 876 1384 Explorer.EXE wlanext.exe PID 1384 wrote to memory of 876 1384 Explorer.EXE wlanext.exe PID 876 wrote to memory of 1668 876 wlanext.exe cmd.exe PID 876 wrote to memory of 1668 876 wlanext.exe cmd.exe PID 876 wrote to memory of 1668 876 wlanext.exe cmd.exe PID 876 wrote to memory of 1668 876 wlanext.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\Payment Details.xlsx"2⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Public\vbc.exe"3⤵
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\OmnbtuhFsJys.exe"3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OmnbtuhFsJys" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8B7D.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"3⤵
- Executes dropped EXE
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp8B7D.tmpMD5
3030641165952bf3bc67953295c86c6a
SHA1616cd4ccfc7f488ddedc39eea5425952db421002
SHA2565a9b6f8346681846a8192cca6ddb635a482138fdf674fe3a38a02754e4941c7f
SHA512f15b6d9481024a0c0916ed223fca9aafb083ddc546a741e1b435d6a78e67d32fc4f9b55fade447e32c1b15afa07e8db3665866d6862e4131d3d126a53274a6e3
-
C:\Users\Public\vbc.exeMD5
0f88779e9500075de85e916637305164
SHA1ee1b3af259e9f03239441681f00aaddd28e4e8fb
SHA256c98eac88f8f4243d7303b806cb58e0a89e33270cb4b33457c91938a2b2746238
SHA512adefee155a0579da0dc75e4aff162635338150a884ddddf47c732a67d69e2f56471cddd64a7cffb743defc040185ce146b713c6511b3dac709d4956e2d30ea31
-
C:\Users\Public\vbc.exeMD5
0f88779e9500075de85e916637305164
SHA1ee1b3af259e9f03239441681f00aaddd28e4e8fb
SHA256c98eac88f8f4243d7303b806cb58e0a89e33270cb4b33457c91938a2b2746238
SHA512adefee155a0579da0dc75e4aff162635338150a884ddddf47c732a67d69e2f56471cddd64a7cffb743defc040185ce146b713c6511b3dac709d4956e2d30ea31
-
C:\Users\Public\vbc.exeMD5
0f88779e9500075de85e916637305164
SHA1ee1b3af259e9f03239441681f00aaddd28e4e8fb
SHA256c98eac88f8f4243d7303b806cb58e0a89e33270cb4b33457c91938a2b2746238
SHA512adefee155a0579da0dc75e4aff162635338150a884ddddf47c732a67d69e2f56471cddd64a7cffb743defc040185ce146b713c6511b3dac709d4956e2d30ea31
-
C:\Users\Public\vbc.exeMD5
0f88779e9500075de85e916637305164
SHA1ee1b3af259e9f03239441681f00aaddd28e4e8fb
SHA256c98eac88f8f4243d7303b806cb58e0a89e33270cb4b33457c91938a2b2746238
SHA512adefee155a0579da0dc75e4aff162635338150a884ddddf47c732a67d69e2f56471cddd64a7cffb743defc040185ce146b713c6511b3dac709d4956e2d30ea31
-
\Users\Public\vbc.exeMD5
0f88779e9500075de85e916637305164
SHA1ee1b3af259e9f03239441681f00aaddd28e4e8fb
SHA256c98eac88f8f4243d7303b806cb58e0a89e33270cb4b33457c91938a2b2746238
SHA512adefee155a0579da0dc75e4aff162635338150a884ddddf47c732a67d69e2f56471cddd64a7cffb743defc040185ce146b713c6511b3dac709d4956e2d30ea31
-
\Users\Public\vbc.exeMD5
0f88779e9500075de85e916637305164
SHA1ee1b3af259e9f03239441681f00aaddd28e4e8fb
SHA256c98eac88f8f4243d7303b806cb58e0a89e33270cb4b33457c91938a2b2746238
SHA512adefee155a0579da0dc75e4aff162635338150a884ddddf47c732a67d69e2f56471cddd64a7cffb743defc040185ce146b713c6511b3dac709d4956e2d30ea31
-
\Users\Public\vbc.exeMD5
0f88779e9500075de85e916637305164
SHA1ee1b3af259e9f03239441681f00aaddd28e4e8fb
SHA256c98eac88f8f4243d7303b806cb58e0a89e33270cb4b33457c91938a2b2746238
SHA512adefee155a0579da0dc75e4aff162635338150a884ddddf47c732a67d69e2f56471cddd64a7cffb743defc040185ce146b713c6511b3dac709d4956e2d30ea31
-
\Users\Public\vbc.exeMD5
0f88779e9500075de85e916637305164
SHA1ee1b3af259e9f03239441681f00aaddd28e4e8fb
SHA256c98eac88f8f4243d7303b806cb58e0a89e33270cb4b33457c91938a2b2746238
SHA512adefee155a0579da0dc75e4aff162635338150a884ddddf47c732a67d69e2f56471cddd64a7cffb743defc040185ce146b713c6511b3dac709d4956e2d30ea31
-
memory/876-89-0x0000000000000000-mapping.dmp
-
memory/876-94-0x0000000000550000-0x00000000005E3000-memory.dmpFilesize
588KB
-
memory/876-91-0x00000000000D0000-0x00000000000FF000-memory.dmpFilesize
188KB
-
memory/876-93-0x0000000002070000-0x0000000002373000-memory.dmpFilesize
3.0MB
-
memory/876-90-0x0000000000530000-0x0000000000546000-memory.dmpFilesize
88KB
-
memory/896-73-0x0000000000000000-mapping.dmp
-
memory/1192-72-0x0000000000000000-mapping.dmp
-
memory/1192-88-0x00000000022A0000-0x0000000002EEA000-memory.dmpFilesize
12.3MB
-
memory/1192-84-0x00000000022A0000-0x0000000002EEA000-memory.dmpFilesize
12.3MB
-
memory/1192-82-0x00000000022A0000-0x0000000002EEA000-memory.dmpFilesize
12.3MB
-
memory/1384-95-0x00000000069B0000-0x0000000006A8E000-memory.dmpFilesize
888KB
-
memory/1384-87-0x0000000006E80000-0x0000000006FE3000-memory.dmpFilesize
1.4MB
-
memory/1444-57-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1444-56-0x0000000071A81000-0x0000000071A83000-memory.dmpFilesize
8KB
-
memory/1444-55-0x000000002FA61000-0x000000002FA64000-memory.dmpFilesize
12KB
-
memory/1444-96-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1544-69-0x0000000000200000-0x0000000000208000-memory.dmpFilesize
32KB
-
memory/1544-63-0x0000000000000000-mapping.dmp
-
memory/1544-71-0x0000000005130000-0x00000000051AE000-memory.dmpFilesize
504KB
-
memory/1544-70-0x0000000000C60000-0x0000000000C61000-memory.dmpFilesize
4KB
-
memory/1544-66-0x0000000000CA0000-0x0000000000CA1000-memory.dmpFilesize
4KB
-
memory/1596-85-0x0000000000D60000-0x0000000001063000-memory.dmpFilesize
3.0MB
-
memory/1596-86-0x00000000002E0000-0x00000000002F4000-memory.dmpFilesize
80KB
-
memory/1596-80-0x000000000041F160-mapping.dmp
-
memory/1596-79-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1596-77-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1596-78-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1632-58-0x00000000765D1000-0x00000000765D3000-memory.dmpFilesize
8KB
-
memory/1668-92-0x0000000000000000-mapping.dmp