Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
18-02-2022 17:49
Static task
static1
Behavioral task
behavioral1
Sample
SC10641.xlsx
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
SC10641.xlsx
Resource
win10v2004-en-20220112
General
-
Target
SC10641.xlsx
-
Size
165KB
-
MD5
11aac7b8fe45c352c86c50c440ec5194
-
SHA1
dae10515c53dc33378e7b5cc6e8b32b380d61c98
-
SHA256
77c5062163c29fc069bf6b25d78284461f71028f3b688e0ac88397038e59f5ce
-
SHA512
84cf52f480a05a3f216b27d6db7a7e73c5bc1196650e31f6cdbe2c30396f8262cc49aaa0f466758e334ee6658a8872ad42baf7e484d67e1724551a15667d62bf
Malware Config
Extracted
xloader
2.5
ahc8
192451.com
wwwripostes.net
sirikhalsalaw.com
bitterbaybay.com
stella-scrubs.com
almanecermezcal.com
goodgood.online
translate-now.online
sincerefilm.com
quadrantforensics.com
johnfrenchart.com
plick-click.com
alnileen.com
tghi.xyz
172711.com
maymakita.com
punnyaseva.com
ukash-online.com
sho-yururi-blog.com
hebergement-solidaire.com
civicinfluencers.net
gzhf8888.com
kuleallstar.com
palisadeslodgecondos.com
holyhirschsprungs.com
azalearoseuk.com
jaggllc.com
italianrofrow.xyz
ioewur.xyz
3a5hlv.icu
kitcycle.com
estate.xyz
ankaraescortvip.xyz
richclubsite2001.xyz
kastore.website
515pleasantvalleyway.com
sittlermd.com
mytemple.group
tiny-wagen.com
sharaleesvintageflames.com
mentalesteem.com
sport-newss.online
fbve.space
lovingtruebloodindallas.com
eaglehospitality.biz
roofrepairnow.info
mcrosfts-updata.digital
cimpactinc.com
greatnotleyeast.com
lovely-tics.com
douglas-enterprise.com
dayannalima.online
ksodl.com
rainbowlampro.com
theinteriorsfurniture.com
eidmueller.email
cg020.online
gta6fuzhu.com
cinemaocity.com
hopeitivity.com
savageequipment.biz
groceriesbazaar.com
hempgotas.com
casino-pharaon-play.xyz
ralfrassendnk-login.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1724-71-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1724-74-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1768-90-0x00000000000D0000-0x00000000000F9000-memory.dmp xloader -
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 4 872 EQNEDT32.EXE -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
vbc.exevbc.exepid process 1596 vbc.exe 1724 vbc.exe -
Loads dropped DLL 9 IoCs
Processes:
EQNEDT32.EXEWerFault.exepid process 872 EQNEDT32.EXE 872 EQNEDT32.EXE 872 EQNEDT32.EXE 872 EQNEDT32.EXE 1372 WerFault.exe 1372 WerFault.exe 1372 WerFault.exe 1372 WerFault.exe 1372 WerFault.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 4 IoCs
Processes:
vbc.exevbc.exewininit.exedescription pid process target process PID 1596 set thread context of 1724 1596 vbc.exe vbc.exe PID 1724 set thread context of 1412 1724 vbc.exe Explorer.EXE PID 1724 set thread context of 1412 1724 vbc.exe Explorer.EXE PID 1768 set thread context of 1412 1768 wininit.exe Explorer.EXE -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1372 1596 WerFault.exe vbc.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
EXCEL.EXEdescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE -
Modifies registry class 64 IoCs
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597} EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14 EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\"" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1904 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 34 IoCs
Processes:
vbc.exeWerFault.exewininit.exepid process 1724 vbc.exe 1724 vbc.exe 1372 WerFault.exe 1372 WerFault.exe 1372 WerFault.exe 1372 WerFault.exe 1372 WerFault.exe 1724 vbc.exe 1768 wininit.exe 1768 wininit.exe 1768 wininit.exe 1768 wininit.exe 1768 wininit.exe 1768 wininit.exe 1768 wininit.exe 1768 wininit.exe 1768 wininit.exe 1768 wininit.exe 1768 wininit.exe 1768 wininit.exe 1768 wininit.exe 1768 wininit.exe 1768 wininit.exe 1768 wininit.exe 1768 wininit.exe 1768 wininit.exe 1768 wininit.exe 1768 wininit.exe 1768 wininit.exe 1768 wininit.exe 1768 wininit.exe 1768 wininit.exe 1768 wininit.exe 1768 wininit.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
WerFault.exepid process 1372 WerFault.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
vbc.exewininit.exepid process 1724 vbc.exe 1724 vbc.exe 1724 vbc.exe 1724 vbc.exe 1768 wininit.exe 1768 wininit.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
vbc.exevbc.exeWerFault.exeExplorer.EXEwininit.exedescription pid process Token: SeDebugPrivilege 1596 vbc.exe Token: SeDebugPrivilege 1724 vbc.exe Token: SeDebugPrivilege 1372 WerFault.exe Token: SeShutdownPrivilege 1412 Explorer.EXE Token: SeDebugPrivilege 1768 wininit.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1412 Explorer.EXE 1412 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1412 Explorer.EXE 1412 Explorer.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1904 EXCEL.EXE 1904 EXCEL.EXE 1904 EXCEL.EXE -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
EQNEDT32.EXEvbc.exeExplorer.EXEwininit.exedescription pid process target process PID 872 wrote to memory of 1596 872 EQNEDT32.EXE vbc.exe PID 872 wrote to memory of 1596 872 EQNEDT32.EXE vbc.exe PID 872 wrote to memory of 1596 872 EQNEDT32.EXE vbc.exe PID 872 wrote to memory of 1596 872 EQNEDT32.EXE vbc.exe PID 1596 wrote to memory of 1724 1596 vbc.exe vbc.exe PID 1596 wrote to memory of 1724 1596 vbc.exe vbc.exe PID 1596 wrote to memory of 1724 1596 vbc.exe vbc.exe PID 1596 wrote to memory of 1724 1596 vbc.exe vbc.exe PID 1596 wrote to memory of 1724 1596 vbc.exe vbc.exe PID 1596 wrote to memory of 1724 1596 vbc.exe vbc.exe PID 1596 wrote to memory of 1724 1596 vbc.exe vbc.exe PID 1596 wrote to memory of 1372 1596 vbc.exe WerFault.exe PID 1596 wrote to memory of 1372 1596 vbc.exe WerFault.exe PID 1596 wrote to memory of 1372 1596 vbc.exe WerFault.exe PID 1596 wrote to memory of 1372 1596 vbc.exe WerFault.exe PID 1412 wrote to memory of 1768 1412 Explorer.EXE wininit.exe PID 1412 wrote to memory of 1768 1412 Explorer.EXE wininit.exe PID 1412 wrote to memory of 1768 1412 Explorer.EXE wininit.exe PID 1412 wrote to memory of 1768 1412 Explorer.EXE wininit.exe PID 1768 wrote to memory of 1144 1768 wininit.exe cmd.exe PID 1768 wrote to memory of 1144 1768 wininit.exe cmd.exe PID 1768 wrote to memory of 1144 1768 wininit.exe cmd.exe PID 1768 wrote to memory of 1144 1768 wininit.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\SC10641.xlsx2⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1904 -
C:\Windows\SysWOW64\wininit.exe"C:\Windows\SysWOW64\wininit.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Public\vbc.exe"3⤵PID:1144
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1724 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 14723⤵
- Loads dropped DLL
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1372
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\vbc.exeMD5
92c35904f4cf224c1a26f7162e465b02
SHA1d4d1635404188075b42f49c4714cc85faa54e71c
SHA256bb81812044069608e1ba320fcb7b878c5b6895f5bf91c93027ab4161042d01c7
SHA51243f28013fa83da1957cda63cdc07b12a4ee9e16f54ed1f8ff36d83d3ce3dff7d710a630e8f042291162eb225e3cd6c08c018fea28e87aa4ac3f0a24b2879c9a8
-
C:\Users\Public\vbc.exeMD5
92c35904f4cf224c1a26f7162e465b02
SHA1d4d1635404188075b42f49c4714cc85faa54e71c
SHA256bb81812044069608e1ba320fcb7b878c5b6895f5bf91c93027ab4161042d01c7
SHA51243f28013fa83da1957cda63cdc07b12a4ee9e16f54ed1f8ff36d83d3ce3dff7d710a630e8f042291162eb225e3cd6c08c018fea28e87aa4ac3f0a24b2879c9a8
-
C:\Users\Public\vbc.exeMD5
92c35904f4cf224c1a26f7162e465b02
SHA1d4d1635404188075b42f49c4714cc85faa54e71c
SHA256bb81812044069608e1ba320fcb7b878c5b6895f5bf91c93027ab4161042d01c7
SHA51243f28013fa83da1957cda63cdc07b12a4ee9e16f54ed1f8ff36d83d3ce3dff7d710a630e8f042291162eb225e3cd6c08c018fea28e87aa4ac3f0a24b2879c9a8
-
\Users\Public\vbc.exeMD5
92c35904f4cf224c1a26f7162e465b02
SHA1d4d1635404188075b42f49c4714cc85faa54e71c
SHA256bb81812044069608e1ba320fcb7b878c5b6895f5bf91c93027ab4161042d01c7
SHA51243f28013fa83da1957cda63cdc07b12a4ee9e16f54ed1f8ff36d83d3ce3dff7d710a630e8f042291162eb225e3cd6c08c018fea28e87aa4ac3f0a24b2879c9a8
-
\Users\Public\vbc.exeMD5
92c35904f4cf224c1a26f7162e465b02
SHA1d4d1635404188075b42f49c4714cc85faa54e71c
SHA256bb81812044069608e1ba320fcb7b878c5b6895f5bf91c93027ab4161042d01c7
SHA51243f28013fa83da1957cda63cdc07b12a4ee9e16f54ed1f8ff36d83d3ce3dff7d710a630e8f042291162eb225e3cd6c08c018fea28e87aa4ac3f0a24b2879c9a8
-
\Users\Public\vbc.exeMD5
92c35904f4cf224c1a26f7162e465b02
SHA1d4d1635404188075b42f49c4714cc85faa54e71c
SHA256bb81812044069608e1ba320fcb7b878c5b6895f5bf91c93027ab4161042d01c7
SHA51243f28013fa83da1957cda63cdc07b12a4ee9e16f54ed1f8ff36d83d3ce3dff7d710a630e8f042291162eb225e3cd6c08c018fea28e87aa4ac3f0a24b2879c9a8
-
\Users\Public\vbc.exeMD5
92c35904f4cf224c1a26f7162e465b02
SHA1d4d1635404188075b42f49c4714cc85faa54e71c
SHA256bb81812044069608e1ba320fcb7b878c5b6895f5bf91c93027ab4161042d01c7
SHA51243f28013fa83da1957cda63cdc07b12a4ee9e16f54ed1f8ff36d83d3ce3dff7d710a630e8f042291162eb225e3cd6c08c018fea28e87aa4ac3f0a24b2879c9a8
-
\Users\Public\vbc.exeMD5
92c35904f4cf224c1a26f7162e465b02
SHA1d4d1635404188075b42f49c4714cc85faa54e71c
SHA256bb81812044069608e1ba320fcb7b878c5b6895f5bf91c93027ab4161042d01c7
SHA51243f28013fa83da1957cda63cdc07b12a4ee9e16f54ed1f8ff36d83d3ce3dff7d710a630e8f042291162eb225e3cd6c08c018fea28e87aa4ac3f0a24b2879c9a8
-
\Users\Public\vbc.exeMD5
92c35904f4cf224c1a26f7162e465b02
SHA1d4d1635404188075b42f49c4714cc85faa54e71c
SHA256bb81812044069608e1ba320fcb7b878c5b6895f5bf91c93027ab4161042d01c7
SHA51243f28013fa83da1957cda63cdc07b12a4ee9e16f54ed1f8ff36d83d3ce3dff7d710a630e8f042291162eb225e3cd6c08c018fea28e87aa4ac3f0a24b2879c9a8
-
\Users\Public\vbc.exeMD5
92c35904f4cf224c1a26f7162e465b02
SHA1d4d1635404188075b42f49c4714cc85faa54e71c
SHA256bb81812044069608e1ba320fcb7b878c5b6895f5bf91c93027ab4161042d01c7
SHA51243f28013fa83da1957cda63cdc07b12a4ee9e16f54ed1f8ff36d83d3ce3dff7d710a630e8f042291162eb225e3cd6c08c018fea28e87aa4ac3f0a24b2879c9a8
-
\Users\Public\vbc.exeMD5
92c35904f4cf224c1a26f7162e465b02
SHA1d4d1635404188075b42f49c4714cc85faa54e71c
SHA256bb81812044069608e1ba320fcb7b878c5b6895f5bf91c93027ab4161042d01c7
SHA51243f28013fa83da1957cda63cdc07b12a4ee9e16f54ed1f8ff36d83d3ce3dff7d710a630e8f042291162eb225e3cd6c08c018fea28e87aa4ac3f0a24b2879c9a8
-
\Users\Public\vbc.exeMD5
92c35904f4cf224c1a26f7162e465b02
SHA1d4d1635404188075b42f49c4714cc85faa54e71c
SHA256bb81812044069608e1ba320fcb7b878c5b6895f5bf91c93027ab4161042d01c7
SHA51243f28013fa83da1957cda63cdc07b12a4ee9e16f54ed1f8ff36d83d3ce3dff7d710a630e8f042291162eb225e3cd6c08c018fea28e87aa4ac3f0a24b2879c9a8
-
memory/872-58-0x0000000074F01000-0x0000000074F03000-memory.dmpFilesize
8KB
-
memory/1372-84-0x00000000004E0000-0x00000000004E1000-memory.dmpFilesize
4KB
-
memory/1412-93-0x0000000006AF0000-0x0000000006B9F000-memory.dmpFilesize
700KB
-
memory/1412-88-0x0000000006800000-0x00000000068C6000-memory.dmpFilesize
792KB
-
memory/1412-76-0x0000000006D00000-0x0000000006E4F000-memory.dmpFilesize
1.3MB
-
memory/1596-65-0x00000000012A0000-0x00000000012AA000-memory.dmpFilesize
40KB
-
memory/1596-68-0x00000000007A0000-0x00000000007D4000-memory.dmpFilesize
208KB
-
memory/1596-67-0x0000000004EF0000-0x0000000004EF1000-memory.dmpFilesize
4KB
-
memory/1596-66-0x000000006BA6E000-0x000000006BA6F000-memory.dmpFilesize
4KB
-
memory/1724-69-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1724-87-0x00000000004E0000-0x00000000004F1000-memory.dmpFilesize
68KB
-
memory/1724-78-0x0000000000450000-0x0000000000461000-memory.dmpFilesize
68KB
-
memory/1724-75-0x000000000041D000-0x000000000041E000-memory.dmpFilesize
4KB
-
memory/1724-74-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1724-71-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1724-86-0x000000000041D000-0x000000000041E000-memory.dmpFilesize
4KB
-
memory/1724-77-0x0000000000700000-0x0000000000A03000-memory.dmpFilesize
3.0MB
-
memory/1724-70-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1768-90-0x00000000000D0000-0x00000000000F9000-memory.dmpFilesize
164KB
-
memory/1768-89-0x0000000000390000-0x00000000003AA000-memory.dmpFilesize
104KB
-
memory/1768-91-0x0000000001EA0000-0x00000000021A3000-memory.dmpFilesize
3.0MB
-
memory/1768-92-0x0000000001DA0000-0x0000000001E30000-memory.dmpFilesize
576KB
-
memory/1904-55-0x0000000070FD1000-0x0000000070FD3000-memory.dmpFilesize
8KB
-
memory/1904-54-0x000000002FBE1000-0x000000002FBE4000-memory.dmpFilesize
12KB
-
memory/1904-56-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1904-57-0x0000000071FBD000-0x0000000071FC8000-memory.dmpFilesize
44KB
-
memory/1904-95-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB