Analysis
-
max time kernel
157s -
max time network
148s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
25-01-2022 09:45
Static task
static1
Behavioral task
behavioral1
Sample
Quotation.xlsx
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
Quotation.xlsx
Resource
win10-en-20211208
General
-
Target
Quotation.xlsx
-
Size
187KB
-
MD5
5df4a038cc4bba817a9daff5fc087a43
-
SHA1
8834957b839145353b4b7ba7dadad4283db5dc64
-
SHA256
65e00716aa71025d9cb4c8a9d84fe400fc09e97ad9dc1c0587cbb995ca9edbe8
-
SHA512
f6bfad5a8d61b701d3031e89999020d225a5db6d5d8b79f96e778005c4ef00703e0bbe0a25e4fe52887d261fda29fc4ff6610c55b152ce98f16fb901928af865
Malware Config
Extracted
formbook
4.1
g2fg
snowcrash.website
pointman.us
newheartvalve.care
drandl.com
sandspringsramblers.com
programagubernamental.online
boja.us
mvrsnike.com
mentallyillmotherhood.com
facom.us
programagubernamental.store
izivente.com
roller-v.fr
amazonbioactives.com
metaverseapple.xyz
5gt-mobilevsverizon.com
gtwebsolutions.co
scottdunn.life
usdp.trade
pikmin.run
cardano-dogs.com
bf2hgfy.xyz
teslafoot.com
rubertquintana.com
wellsfargroewards.com
santel.us
couponatonline.com
theunitedhomeland.com
pmstnly.com
strlocal.com
shelleysmucker.com
youser.online
emansdesign.com
usnikeshoesbot.top
starfish.press
scotwork.us
metamorgana.com
onyxbx.net
rivas.company
firstcoastalfb.com
onpurposetraumainformedcare.com
celimot.xyz
jecunikepemej.rest
lenovolatenightit.com
unitedsterlingcompanyky.com
safety2venture.us
facebookismetanow.com
scottdunn.review
mentallyillmotherhood.com
firstincargo.com
vikavivi.com
investmenofpairs.club
nexans.cloud
farcloud.fr
ivermectinforhumans.quest
5gmalesdf.sbs
majenta.info
6vvvvvwmetam.top
metafirstclass.com
firstcoinnews.com
btcetffutures.online
funinfortmyers.com
mangoirslk.top
metaversebasicprivacy.com
blancheshelley.xyz
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1644-77-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1236-88-0x0000000000090000-0x00000000000BF000-memory.dmp formbook -
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 4 864 EQNEDT32.EXE -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
vbc.exevbc.exepid process 1140 vbc.exe 1644 vbc.exe -
Loads dropped DLL 4 IoCs
Processes:
EQNEDT32.EXEpid process 864 EQNEDT32.EXE 864 EQNEDT32.EXE 864 EQNEDT32.EXE 864 EQNEDT32.EXE -
Uses the VBS compiler for execution 1 TTPs
-
Drops file in System32 directory 1 IoCs
Processes:
powershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
vbc.exevbc.exerundll32.exedescription pid process target process PID 1140 set thread context of 1644 1140 vbc.exe vbc.exe PID 1644 set thread context of 1360 1644 vbc.exe Explorer.EXE PID 1236 set thread context of 1360 1236 rundll32.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE -
Modifies registry class 64 IoCs
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597} EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1720 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 19 IoCs
Processes:
vbc.exepowershell.exerundll32.exepid process 1644 vbc.exe 1644 vbc.exe 1292 powershell.exe 1236 rundll32.exe 1236 rundll32.exe 1236 rundll32.exe 1236 rundll32.exe 1236 rundll32.exe 1236 rundll32.exe 1236 rundll32.exe 1236 rundll32.exe 1236 rundll32.exe 1236 rundll32.exe 1236 rundll32.exe 1236 rundll32.exe 1236 rundll32.exe 1236 rundll32.exe 1236 rundll32.exe 1236 rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1360 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
vbc.exerundll32.exepid process 1644 vbc.exe 1644 vbc.exe 1644 vbc.exe 1236 rundll32.exe 1236 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
vbc.exepowershell.exerundll32.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1644 vbc.exe Token: SeDebugPrivilege 1292 powershell.exe Token: SeDebugPrivilege 1236 rundll32.exe Token: SeShutdownPrivilege 1360 Explorer.EXE Token: SeShutdownPrivilege 1360 Explorer.EXE Token: SeShutdownPrivilege 1360 Explorer.EXE Token: SeShutdownPrivilege 1360 Explorer.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1720 EXCEL.EXE 1720 EXCEL.EXE 1720 EXCEL.EXE -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
EQNEDT32.EXEvbc.exeExplorer.EXErundll32.exedescription pid process target process PID 864 wrote to memory of 1140 864 EQNEDT32.EXE vbc.exe PID 864 wrote to memory of 1140 864 EQNEDT32.EXE vbc.exe PID 864 wrote to memory of 1140 864 EQNEDT32.EXE vbc.exe PID 864 wrote to memory of 1140 864 EQNEDT32.EXE vbc.exe PID 1140 wrote to memory of 1292 1140 vbc.exe powershell.exe PID 1140 wrote to memory of 1292 1140 vbc.exe powershell.exe PID 1140 wrote to memory of 1292 1140 vbc.exe powershell.exe PID 1140 wrote to memory of 1292 1140 vbc.exe powershell.exe PID 1140 wrote to memory of 1688 1140 vbc.exe schtasks.exe PID 1140 wrote to memory of 1688 1140 vbc.exe schtasks.exe PID 1140 wrote to memory of 1688 1140 vbc.exe schtasks.exe PID 1140 wrote to memory of 1688 1140 vbc.exe schtasks.exe PID 1140 wrote to memory of 1644 1140 vbc.exe vbc.exe PID 1140 wrote to memory of 1644 1140 vbc.exe vbc.exe PID 1140 wrote to memory of 1644 1140 vbc.exe vbc.exe PID 1140 wrote to memory of 1644 1140 vbc.exe vbc.exe PID 1140 wrote to memory of 1644 1140 vbc.exe vbc.exe PID 1140 wrote to memory of 1644 1140 vbc.exe vbc.exe PID 1140 wrote to memory of 1644 1140 vbc.exe vbc.exe PID 1360 wrote to memory of 1236 1360 Explorer.EXE rundll32.exe PID 1360 wrote to memory of 1236 1360 Explorer.EXE rundll32.exe PID 1360 wrote to memory of 1236 1360 Explorer.EXE rundll32.exe PID 1360 wrote to memory of 1236 1360 Explorer.EXE rundll32.exe PID 1360 wrote to memory of 1236 1360 Explorer.EXE rundll32.exe PID 1360 wrote to memory of 1236 1360 Explorer.EXE rundll32.exe PID 1360 wrote to memory of 1236 1360 Explorer.EXE rundll32.exe PID 1236 wrote to memory of 1608 1236 rundll32.exe cmd.exe PID 1236 wrote to memory of 1608 1236 rundll32.exe cmd.exe PID 1236 wrote to memory of 1608 1236 rundll32.exe cmd.exe PID 1236 wrote to memory of 1608 1236 rundll32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\Quotation.xlsx2⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Public\vbc.exe"3⤵
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\pZwlVIRL.exe"3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pZwlVIRL" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEA01.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpEA01.tmpMD5
dfcbb5594aa082a044916fdc0592bcfc
SHA127d93b2056936d7777b3677ff6de18e27011e6a2
SHA2565fe30f76e6113796602ca215fe5f39f27f82e0529b13fddf5626979d5a41105b
SHA512785544b67b2b98d697b07cfe9f1f42b9db154568aab3e1fa712e02c597111b163b9ab646f6823bb94df444bcc7d5eb725ac8a0a5418cf6629ed0843c416e4775
-
C:\Users\Public\vbc.exeMD5
4046b8ca88cdab84c7414a71f2431485
SHA1418ef8407df18bf53b24e85d2b9534f04fbbd109
SHA256b63c82c7ada645bc96da74ebd031970c0ee2e7a568c2929181c146144682b2c3
SHA5125641b9c7a57945b40886b648044fd3bcdc4c8e16d83141e10643aa30802ec350d39fb8ce089286e5df1ff137588f2dd61ce6477e808cab5bdf95edbc8859eec7
-
C:\Users\Public\vbc.exeMD5
4046b8ca88cdab84c7414a71f2431485
SHA1418ef8407df18bf53b24e85d2b9534f04fbbd109
SHA256b63c82c7ada645bc96da74ebd031970c0ee2e7a568c2929181c146144682b2c3
SHA5125641b9c7a57945b40886b648044fd3bcdc4c8e16d83141e10643aa30802ec350d39fb8ce089286e5df1ff137588f2dd61ce6477e808cab5bdf95edbc8859eec7
-
C:\Users\Public\vbc.exeMD5
4046b8ca88cdab84c7414a71f2431485
SHA1418ef8407df18bf53b24e85d2b9534f04fbbd109
SHA256b63c82c7ada645bc96da74ebd031970c0ee2e7a568c2929181c146144682b2c3
SHA5125641b9c7a57945b40886b648044fd3bcdc4c8e16d83141e10643aa30802ec350d39fb8ce089286e5df1ff137588f2dd61ce6477e808cab5bdf95edbc8859eec7
-
\Users\Public\vbc.exeMD5
4046b8ca88cdab84c7414a71f2431485
SHA1418ef8407df18bf53b24e85d2b9534f04fbbd109
SHA256b63c82c7ada645bc96da74ebd031970c0ee2e7a568c2929181c146144682b2c3
SHA5125641b9c7a57945b40886b648044fd3bcdc4c8e16d83141e10643aa30802ec350d39fb8ce089286e5df1ff137588f2dd61ce6477e808cab5bdf95edbc8859eec7
-
\Users\Public\vbc.exeMD5
4046b8ca88cdab84c7414a71f2431485
SHA1418ef8407df18bf53b24e85d2b9534f04fbbd109
SHA256b63c82c7ada645bc96da74ebd031970c0ee2e7a568c2929181c146144682b2c3
SHA5125641b9c7a57945b40886b648044fd3bcdc4c8e16d83141e10643aa30802ec350d39fb8ce089286e5df1ff137588f2dd61ce6477e808cab5bdf95edbc8859eec7
-
\Users\Public\vbc.exeMD5
4046b8ca88cdab84c7414a71f2431485
SHA1418ef8407df18bf53b24e85d2b9534f04fbbd109
SHA256b63c82c7ada645bc96da74ebd031970c0ee2e7a568c2929181c146144682b2c3
SHA5125641b9c7a57945b40886b648044fd3bcdc4c8e16d83141e10643aa30802ec350d39fb8ce089286e5df1ff137588f2dd61ce6477e808cab5bdf95edbc8859eec7
-
\Users\Public\vbc.exeMD5
4046b8ca88cdab84c7414a71f2431485
SHA1418ef8407df18bf53b24e85d2b9534f04fbbd109
SHA256b63c82c7ada645bc96da74ebd031970c0ee2e7a568c2929181c146144682b2c3
SHA5125641b9c7a57945b40886b648044fd3bcdc4c8e16d83141e10643aa30802ec350d39fb8ce089286e5df1ff137588f2dd61ce6477e808cab5bdf95edbc8859eec7
-
memory/1140-65-0x0000000001270000-0x0000000001344000-memory.dmpFilesize
848KB
-
memory/1140-67-0x0000000004F30000-0x0000000004F31000-memory.dmpFilesize
4KB
-
memory/1140-68-0x00000000009A0000-0x00000000009AE000-memory.dmpFilesize
56KB
-
memory/1140-69-0x000000007EF40000-0x000000007EF41000-memory.dmpFilesize
4KB
-
memory/1140-70-0x0000000005830000-0x00000000058E0000-memory.dmpFilesize
704KB
-
memory/1236-88-0x0000000000090000-0x00000000000BF000-memory.dmpFilesize
188KB
-
memory/1236-89-0x0000000001F80000-0x0000000002283000-memory.dmpFilesize
3.0MB
-
memory/1236-90-0x0000000002290000-0x0000000002323000-memory.dmpFilesize
588KB
-
memory/1236-87-0x0000000000710000-0x000000000071E000-memory.dmpFilesize
56KB
-
memory/1292-84-0x0000000001DF1000-0x0000000001DF2000-memory.dmpFilesize
4KB
-
memory/1292-79-0x0000000001DF0000-0x0000000001DF1000-memory.dmpFilesize
4KB
-
memory/1292-85-0x0000000001DF2000-0x0000000001DF4000-memory.dmpFilesize
8KB
-
memory/1360-92-0x0000000004EF0000-0x0000000004FDD000-memory.dmpFilesize
948KB
-
memory/1360-83-0x0000000006DF0000-0x0000000006F7F000-memory.dmpFilesize
1.6MB
-
memory/1644-76-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1644-80-0x0000000000940000-0x0000000000C43000-memory.dmpFilesize
3.0MB
-
memory/1644-82-0x00000000003D0000-0x00000000003E4000-memory.dmpFilesize
80KB
-
memory/1644-77-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1644-75-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1720-54-0x000000002F651000-0x000000002F654000-memory.dmpFilesize
12KB
-
memory/1720-56-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1720-55-0x0000000070D61000-0x0000000070D63000-memory.dmpFilesize
8KB
-
memory/1720-91-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1720-57-0x0000000075D61000-0x0000000075D63000-memory.dmpFilesize
8KB