Analysis
-
max time kernel
155s -
max time network
151s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
27-01-2022 13:05
Static task
static1
Behavioral task
behavioral1
Sample
Quotation.xlsx
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
Quotation.xlsx
Resource
win10-en-20211208
General
-
Target
Quotation.xlsx
-
Size
187KB
-
MD5
b23f5b2d0dd2b26171acf1b853bd7fa1
-
SHA1
c59ef6b1adbeea79ac12304e6c2b6d1bba326b21
-
SHA256
ea2eb32bfadd49c0bc833a50ed2b7d73f42175378fb2e7ff53e3612b5ae8f6f1
-
SHA512
c6452622f0b262d7eb168a4946106ed7d32af0edc265ac9ab4b704a2099ba41ac1dba9faeb40828b02d8566e9c8a928dee548aa6adc697caf5b888df08dbc1e6
Malware Config
Extracted
formbook
4.1
g2fg
snowcrash.website
pointman.us
newheartvalve.care
drandl.com
sandspringsramblers.com
programagubernamental.online
boja.us
mvrsnike.com
mentallyillmotherhood.com
facom.us
programagubernamental.store
izivente.com
roller-v.fr
amazonbioactives.com
metaverseapple.xyz
5gt-mobilevsverizon.com
gtwebsolutions.co
scottdunn.life
usdp.trade
pikmin.run
cardano-dogs.com
bf2hgfy.xyz
teslafoot.com
rubertquintana.com
wellsfargroewards.com
santel.us
couponatonline.com
theunitedhomeland.com
pmstnly.com
strlocal.com
shelleysmucker.com
youser.online
emansdesign.com
usnikeshoesbot.top
starfish.press
scotwork.us
metamorgana.com
onyxbx.net
rivas.company
firstcoastalfb.com
onpurposetraumainformedcare.com
celimot.xyz
jecunikepemej.rest
lenovolatenightit.com
unitedsterlingcompanyky.com
safety2venture.us
facebookismetanow.com
scottdunn.review
mentallyillmotherhood.com
firstincargo.com
vikavivi.com
investmenofpairs.club
nexans.cloud
farcloud.fr
ivermectinforhumans.quest
5gmalesdf.sbs
majenta.info
6vvvvvwmetam.top
metafirstclass.com
firstcoinnews.com
btcetffutures.online
funinfortmyers.com
mangoirslk.top
metaversebasicprivacy.com
blancheshelley.xyz
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1760-77-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1984-86-0x0000000000090000-0x00000000000BF000-memory.dmp formbook -
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 4 872 EQNEDT32.EXE -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
vbc.exevbc.exepid process 1976 vbc.exe 1760 vbc.exe -
Loads dropped DLL 4 IoCs
Processes:
EQNEDT32.EXEpid process 872 EQNEDT32.EXE 872 EQNEDT32.EXE 872 EQNEDT32.EXE 872 EQNEDT32.EXE -
Uses the VBS compiler for execution 1 TTPs
-
Drops file in System32 directory 1 IoCs
Processes:
powershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
vbc.exevbc.exemsiexec.exedescription pid process target process PID 1976 set thread context of 1760 1976 vbc.exe vbc.exe PID 1760 set thread context of 1248 1760 vbc.exe Explorer.EXE PID 1984 set thread context of 1248 1984 msiexec.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
EXCEL.EXEdescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE -
Modifies registry class 64 IoCs
Processes:
EXCEL.EXEdescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14 EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1672 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
powershell.exevbc.exemsiexec.exepid process 1736 powershell.exe 1760 vbc.exe 1760 vbc.exe 1984 msiexec.exe 1984 msiexec.exe 1984 msiexec.exe 1984 msiexec.exe 1984 msiexec.exe 1984 msiexec.exe 1984 msiexec.exe 1984 msiexec.exe 1984 msiexec.exe 1984 msiexec.exe 1984 msiexec.exe 1984 msiexec.exe 1984 msiexec.exe 1984 msiexec.exe 1984 msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1248 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
vbc.exemsiexec.exepid process 1760 vbc.exe 1760 vbc.exe 1760 vbc.exe 1984 msiexec.exe 1984 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
powershell.exevbc.exemsiexec.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1736 powershell.exe Token: SeDebugPrivilege 1760 vbc.exe Token: SeDebugPrivilege 1984 msiexec.exe Token: SeShutdownPrivilege 1248 Explorer.EXE Token: SeShutdownPrivilege 1248 Explorer.EXE Token: SeShutdownPrivilege 1248 Explorer.EXE Token: SeShutdownPrivilege 1248 Explorer.EXE -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
EXCEL.EXEpid process 1672 EXCEL.EXE 1672 EXCEL.EXE 1672 EXCEL.EXE 1672 EXCEL.EXE 1672 EXCEL.EXE -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
EQNEDT32.EXEvbc.exeExplorer.EXEmsiexec.exedescription pid process target process PID 872 wrote to memory of 1976 872 EQNEDT32.EXE vbc.exe PID 872 wrote to memory of 1976 872 EQNEDT32.EXE vbc.exe PID 872 wrote to memory of 1976 872 EQNEDT32.EXE vbc.exe PID 872 wrote to memory of 1976 872 EQNEDT32.EXE vbc.exe PID 1976 wrote to memory of 1736 1976 vbc.exe powershell.exe PID 1976 wrote to memory of 1736 1976 vbc.exe powershell.exe PID 1976 wrote to memory of 1736 1976 vbc.exe powershell.exe PID 1976 wrote to memory of 1736 1976 vbc.exe powershell.exe PID 1976 wrote to memory of 1768 1976 vbc.exe schtasks.exe PID 1976 wrote to memory of 1768 1976 vbc.exe schtasks.exe PID 1976 wrote to memory of 1768 1976 vbc.exe schtasks.exe PID 1976 wrote to memory of 1768 1976 vbc.exe schtasks.exe PID 1976 wrote to memory of 1760 1976 vbc.exe vbc.exe PID 1976 wrote to memory of 1760 1976 vbc.exe vbc.exe PID 1976 wrote to memory of 1760 1976 vbc.exe vbc.exe PID 1976 wrote to memory of 1760 1976 vbc.exe vbc.exe PID 1976 wrote to memory of 1760 1976 vbc.exe vbc.exe PID 1976 wrote to memory of 1760 1976 vbc.exe vbc.exe PID 1976 wrote to memory of 1760 1976 vbc.exe vbc.exe PID 1248 wrote to memory of 1984 1248 Explorer.EXE msiexec.exe PID 1248 wrote to memory of 1984 1248 Explorer.EXE msiexec.exe PID 1248 wrote to memory of 1984 1248 Explorer.EXE msiexec.exe PID 1248 wrote to memory of 1984 1248 Explorer.EXE msiexec.exe PID 1248 wrote to memory of 1984 1248 Explorer.EXE msiexec.exe PID 1248 wrote to memory of 1984 1248 Explorer.EXE msiexec.exe PID 1248 wrote to memory of 1984 1248 Explorer.EXE msiexec.exe PID 1984 wrote to memory of 1480 1984 msiexec.exe cmd.exe PID 1984 wrote to memory of 1480 1984 msiexec.exe cmd.exe PID 1984 wrote to memory of 1480 1984 msiexec.exe cmd.exe PID 1984 wrote to memory of 1480 1984 msiexec.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\Quotation.xlsx2⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Public\vbc.exe"3⤵
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\kTtZEsPaZu.exe"3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kTtZEsPaZu" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE6C6.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpE6C6.tmpMD5
2d100d15c7feea086cdfa7f74a191689
SHA1a93dda4d5eac9ad86135f6726c34a23c2e4c1081
SHA25675a8c49798d0abef09f4b2a93ca8a426f5caf93cce46e467951913fbd6f3fd09
SHA512d5b6d46b6855936d104424fe762af9b2a90a1c7f6e50717d0a2d2caad9c99d37ace03b4d9e4c4727ab8a4ed51700560da0c530be32cf12f1d262cb0ab916c19c
-
C:\Users\Public\vbc.exeMD5
43357f80bc70e0db9fb0c304a962e3de
SHA150b6a0a1fb9d9af63523b9a186e88c279c591274
SHA256c4771044788147e2c9acb052dfbf6d291400add558b59ad0e6d0c5f42f3ec3e1
SHA512186ce7a33d8bbbc821f689e7f736f8648b827c981a72eccddbeed1861b05bbc014866c8c138993981f6cd7bb864466ef21912c92f13d8072247efb02f5a60ff0
-
C:\Users\Public\vbc.exeMD5
43357f80bc70e0db9fb0c304a962e3de
SHA150b6a0a1fb9d9af63523b9a186e88c279c591274
SHA256c4771044788147e2c9acb052dfbf6d291400add558b59ad0e6d0c5f42f3ec3e1
SHA512186ce7a33d8bbbc821f689e7f736f8648b827c981a72eccddbeed1861b05bbc014866c8c138993981f6cd7bb864466ef21912c92f13d8072247efb02f5a60ff0
-
C:\Users\Public\vbc.exeMD5
43357f80bc70e0db9fb0c304a962e3de
SHA150b6a0a1fb9d9af63523b9a186e88c279c591274
SHA256c4771044788147e2c9acb052dfbf6d291400add558b59ad0e6d0c5f42f3ec3e1
SHA512186ce7a33d8bbbc821f689e7f736f8648b827c981a72eccddbeed1861b05bbc014866c8c138993981f6cd7bb864466ef21912c92f13d8072247efb02f5a60ff0
-
\Users\Public\vbc.exeMD5
43357f80bc70e0db9fb0c304a962e3de
SHA150b6a0a1fb9d9af63523b9a186e88c279c591274
SHA256c4771044788147e2c9acb052dfbf6d291400add558b59ad0e6d0c5f42f3ec3e1
SHA512186ce7a33d8bbbc821f689e7f736f8648b827c981a72eccddbeed1861b05bbc014866c8c138993981f6cd7bb864466ef21912c92f13d8072247efb02f5a60ff0
-
\Users\Public\vbc.exeMD5
43357f80bc70e0db9fb0c304a962e3de
SHA150b6a0a1fb9d9af63523b9a186e88c279c591274
SHA256c4771044788147e2c9acb052dfbf6d291400add558b59ad0e6d0c5f42f3ec3e1
SHA512186ce7a33d8bbbc821f689e7f736f8648b827c981a72eccddbeed1861b05bbc014866c8c138993981f6cd7bb864466ef21912c92f13d8072247efb02f5a60ff0
-
\Users\Public\vbc.exeMD5
43357f80bc70e0db9fb0c304a962e3de
SHA150b6a0a1fb9d9af63523b9a186e88c279c591274
SHA256c4771044788147e2c9acb052dfbf6d291400add558b59ad0e6d0c5f42f3ec3e1
SHA512186ce7a33d8bbbc821f689e7f736f8648b827c981a72eccddbeed1861b05bbc014866c8c138993981f6cd7bb864466ef21912c92f13d8072247efb02f5a60ff0
-
\Users\Public\vbc.exeMD5
43357f80bc70e0db9fb0c304a962e3de
SHA150b6a0a1fb9d9af63523b9a186e88c279c591274
SHA256c4771044788147e2c9acb052dfbf6d291400add558b59ad0e6d0c5f42f3ec3e1
SHA512186ce7a33d8bbbc821f689e7f736f8648b827c981a72eccddbeed1861b05bbc014866c8c138993981f6cd7bb864466ef21912c92f13d8072247efb02f5a60ff0
-
memory/1248-83-0x0000000004A70000-0x0000000004B35000-memory.dmpFilesize
788KB
-
memory/1248-90-0x00000000073D0000-0x0000000007516000-memory.dmpFilesize
1.3MB
-
memory/1672-54-0x000000002FB31000-0x000000002FB34000-memory.dmpFilesize
12KB
-
memory/1672-89-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1672-55-0x00000000712C1000-0x00000000712C3000-memory.dmpFilesize
8KB
-
memory/1672-57-0x0000000075341000-0x0000000075343000-memory.dmpFilesize
8KB
-
memory/1672-56-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1736-72-0x0000000002360000-0x0000000002FAA000-memory.dmpFilesize
12.3MB
-
memory/1736-73-0x0000000002360000-0x0000000002FAA000-memory.dmpFilesize
12.3MB
-
memory/1736-74-0x0000000002360000-0x0000000002FAA000-memory.dmpFilesize
12.3MB
-
memory/1736-79-0x0000000004B20000-0x0000000004DF2000-memory.dmpFilesize
2.8MB
-
memory/1760-81-0x00000000007D0000-0x0000000000BD3000-memory.dmpFilesize
4.0MB
-
memory/1760-77-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1760-75-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1760-76-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1760-82-0x00000000003A0000-0x00000000003B4000-memory.dmpFilesize
80KB
-
memory/1976-68-0x00000000004C0000-0x00000000004CC000-memory.dmpFilesize
48KB
-
memory/1976-67-0x0000000004B40000-0x0000000004B41000-memory.dmpFilesize
4KB
-
memory/1976-65-0x0000000001110000-0x000000000117E000-memory.dmpFilesize
440KB
-
memory/1976-69-0x00000000050A0000-0x000000000510A000-memory.dmpFilesize
424KB
-
memory/1984-85-0x0000000000DE0000-0x0000000000DF4000-memory.dmpFilesize
80KB
-
memory/1984-86-0x0000000000090000-0x00000000000BF000-memory.dmpFilesize
188KB
-
memory/1984-87-0x0000000002390000-0x0000000002693000-memory.dmpFilesize
3.0MB
-
memory/1984-88-0x0000000000500000-0x0000000000749000-memory.dmpFilesize
2.3MB