Analysis
-
max time kernel
150s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
04-05-2022 06:54
Static task
static1
Behavioral task
behavioral1
Sample
AWB_NO_9284730932.xlsx
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
AWB_NO_9284730932.xlsx
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
decrypted.xlsx
Resource
win7-20220414-en
Behavioral task
behavioral4
Sample
decrypted.xlsx
Resource
win10v2004-20220414-en
General
-
Target
decrypted.xlsx
-
Size
199KB
-
MD5
045fef4f9dae5162449cb0dadbf82df1
-
SHA1
6a26ce7489ad95c4fbae05df9d268ff5ceae5498
-
SHA256
bddcd8a65e3a8a5bccf3d39865ed76e7f69e357ca0094b8324f1f3501b975c91
-
SHA512
2d04bfbbe7036dea4e6ae2def0de54fcdecf118d2ec3bc509ecbbd13587f04f50b0a3970eedc682dc77eb1704248484d954612ac7065786e4f86c5e35ae4c222
Malware Config
Extracted
formbook
4.1
fw02
payer-breakers.com
thesiscoper.com
rental-villa.com
scovikinnovations.com
hydh33.com
allmyshit.rest
lovejaclyn.com
vanessaruizwriting.com
dufonddelaclasse.com
kiddee168.com
monumentalmarketsllc.com
musclegainfatloss.com
avida.info
cosmo-wellness.net
dandelionfusedigital.com
oversizeloadbanners.com
konstelle.store
sdjnsbd.com
czoqg.xyz
5p6xljjse1lq.xyz
10936.loan
primeiropasso.website
salarydetector.net
the6figureshow.com
ritzluxurytransportation.com
5145.design
web3ido.xyz
starweaverdesigns.com
cbdtz.com
sunwall.xyz
ornitv.com
curateddesignsconsulting.com
businesshairways.biz
willacloud.com
accusecures.com
hl243.com
coffellc.icu
eddrugs2018.com
lidakang.xyz
salesstorecolombia.com
ilina.xyz
partieslikethese.com
peymantasnimi.com
datthocu.xyz
cybertechsolutions.xyz
findy.guru
trybes.space
arulinks.com
yuriookinoart.com
largestjerseysstore.com
fortitude-tech.com
ywfjp.com
b1v097f2avze.xyz
abdullahnazhim.com
zhaoav111.info
cegrowing.com
llaveselmuerto.com
7477e.xyz
chabusinessloans.com
ht-brain.com
app-compound.finance
0085208.com
wewinaccidents.com
ztzfirst.xyz
shishlomarket24.biz
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 4 IoCs
Processes:
resource yara_rule behavioral3/memory/1960-76-0x000000000041F150-mapping.dmp formbook behavioral3/memory/1960-75-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral3/memory/1960-79-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral3/memory/1884-90-0x0000000000090000-0x00000000000BF000-memory.dmp formbook -
Blocklisted process makes network request 2 IoCs
Processes:
EQNEDT32.EXEflow pid process 3 1692 EQNEDT32.EXE 4 1692 EQNEDT32.EXE -
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
vbc.exedpxyhbjguk.exedpxyhbjguk.exepid process 1700 vbc.exe 1880 dpxyhbjguk.exe 1960 dpxyhbjguk.exe -
Loads dropped DLL 5 IoCs
Processes:
EQNEDT32.EXEvbc.exedpxyhbjguk.exepid process 1692 EQNEDT32.EXE 1692 EQNEDT32.EXE 1692 EQNEDT32.EXE 1700 vbc.exe 1880 dpxyhbjguk.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 4 IoCs
Processes:
dpxyhbjguk.exedpxyhbjguk.execmstp.exedescription pid process target process PID 1880 set thread context of 1960 1880 dpxyhbjguk.exe dpxyhbjguk.exe PID 1960 set thread context of 1212 1960 dpxyhbjguk.exe Explorer.EXE PID 1960 set thread context of 1212 1960 dpxyhbjguk.exe Explorer.EXE PID 1884 set thread context of 1212 1884 cmstp.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
EXCEL.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND EXCEL.EXE -
Modifies registry class 64 IoCs
Processes:
EXCEL.EXEdescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597} EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1672 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
dpxyhbjguk.execmstp.exepid process 1960 dpxyhbjguk.exe 1960 dpxyhbjguk.exe 1960 dpxyhbjguk.exe 1884 cmstp.exe 1884 cmstp.exe 1884 cmstp.exe 1884 cmstp.exe 1884 cmstp.exe 1884 cmstp.exe 1884 cmstp.exe 1884 cmstp.exe 1884 cmstp.exe 1884 cmstp.exe 1884 cmstp.exe 1884 cmstp.exe 1884 cmstp.exe 1884 cmstp.exe 1884 cmstp.exe 1884 cmstp.exe 1884 cmstp.exe 1884 cmstp.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
dpxyhbjguk.execmstp.exepid process 1960 dpxyhbjguk.exe 1960 dpxyhbjguk.exe 1960 dpxyhbjguk.exe 1960 dpxyhbjguk.exe 1884 cmstp.exe 1884 cmstp.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
dpxyhbjguk.execmstp.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1960 dpxyhbjguk.exe Token: SeDebugPrivilege 1884 cmstp.exe Token: SeShutdownPrivilege 1212 Explorer.EXE Token: SeShutdownPrivilege 1212 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1212 Explorer.EXE 1212 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1212 Explorer.EXE 1212 Explorer.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1672 EXCEL.EXE 1672 EXCEL.EXE 1672 EXCEL.EXE -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
EQNEDT32.EXEvbc.exedpxyhbjguk.exeExplorer.EXEcmstp.exedescription pid process target process PID 1692 wrote to memory of 1700 1692 EQNEDT32.EXE vbc.exe PID 1692 wrote to memory of 1700 1692 EQNEDT32.EXE vbc.exe PID 1692 wrote to memory of 1700 1692 EQNEDT32.EXE vbc.exe PID 1692 wrote to memory of 1700 1692 EQNEDT32.EXE vbc.exe PID 1700 wrote to memory of 1880 1700 vbc.exe dpxyhbjguk.exe PID 1700 wrote to memory of 1880 1700 vbc.exe dpxyhbjguk.exe PID 1700 wrote to memory of 1880 1700 vbc.exe dpxyhbjguk.exe PID 1700 wrote to memory of 1880 1700 vbc.exe dpxyhbjguk.exe PID 1880 wrote to memory of 1960 1880 dpxyhbjguk.exe dpxyhbjguk.exe PID 1880 wrote to memory of 1960 1880 dpxyhbjguk.exe dpxyhbjguk.exe PID 1880 wrote to memory of 1960 1880 dpxyhbjguk.exe dpxyhbjguk.exe PID 1880 wrote to memory of 1960 1880 dpxyhbjguk.exe dpxyhbjguk.exe PID 1880 wrote to memory of 1960 1880 dpxyhbjguk.exe dpxyhbjguk.exe PID 1880 wrote to memory of 1960 1880 dpxyhbjguk.exe dpxyhbjguk.exe PID 1880 wrote to memory of 1960 1880 dpxyhbjguk.exe dpxyhbjguk.exe PID 1212 wrote to memory of 1884 1212 Explorer.EXE cmstp.exe PID 1212 wrote to memory of 1884 1212 Explorer.EXE cmstp.exe PID 1212 wrote to memory of 1884 1212 Explorer.EXE cmstp.exe PID 1212 wrote to memory of 1884 1212 Explorer.EXE cmstp.exe PID 1212 wrote to memory of 1884 1212 Explorer.EXE cmstp.exe PID 1212 wrote to memory of 1884 1212 Explorer.EXE cmstp.exe PID 1212 wrote to memory of 1884 1212 Explorer.EXE cmstp.exe PID 1884 wrote to memory of 1888 1884 cmstp.exe cmd.exe PID 1884 wrote to memory of 1888 1884 cmstp.exe cmd.exe PID 1884 wrote to memory of 1888 1884 cmstp.exe cmd.exe PID 1884 wrote to memory of 1888 1884 cmstp.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\decrypted.xlsx2⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\dpxyhbjguk.exe"3⤵
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dpxyhbjguk.exeC:\Users\Admin\AppData\Local\Temp\dpxyhbjguk.exe C:\Users\Admin\AppData\Local\Temp\cfrdmrwg3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dpxyhbjguk.exeC:\Users\Admin\AppData\Local\Temp\dpxyhbjguk.exe C:\Users\Admin\AppData\Local\Temp\cfrdmrwg4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\3op6m4d1vcvreFilesize
184KB
MD5883e3a371bba46652cef1db30d23e35b
SHA1334a05dc940245cd8d846ae978e3699136cc3175
SHA25694f2ee1b267281c5e118469d49a996c8d2a67df7d3e219cf0196cd8512f1834f
SHA512d3518f5f2ab949c8e89cc1f4e325f1c94648afc30e97b12f048c6d906fa92c1aa575d9e5568cf88d110a02320e4ff3e884f88171e5493469c29aece412327a69
-
C:\Users\Admin\AppData\Local\Temp\cfrdmrwgFilesize
5KB
MD50208d602cb7743704120e763f9cdfa2b
SHA1080b53e3eb750f4bc8b1cfe1bea62444b05954a4
SHA2563aabc70c2694750180a2a4f7e56e389163db8d04d4dba660f8783de8905cf8ce
SHA5123203adc437ccda7fd71c919e9c5ae6e3b75076441430e1325c3c9cc47ea03f9744ee5cc700185469a0db461aa844501d6e2da0940740f35e370e5883eee036e6
-
C:\Users\Admin\AppData\Local\Temp\dpxyhbjguk.exeFilesize
4KB
MD5f3263d29b9c10c4e323227bd098740e8
SHA17ad4193558a06fa0d44315d6db40e620c440f1d3
SHA256629efdf63bd862d249b94fb80c1d5b4ceb43ee0f2be59ed0310c3cd92c162b0a
SHA5128fed273a8dc13f2e2eab1e90c099b769350e5a6226e307f1042923e78360687a4256a35128826d36c147cf7f5f7c2e5ef750109baf768c96a9ebfea01efb0e56
-
C:\Users\Admin\AppData\Local\Temp\dpxyhbjguk.exeFilesize
4KB
MD5f3263d29b9c10c4e323227bd098740e8
SHA17ad4193558a06fa0d44315d6db40e620c440f1d3
SHA256629efdf63bd862d249b94fb80c1d5b4ceb43ee0f2be59ed0310c3cd92c162b0a
SHA5128fed273a8dc13f2e2eab1e90c099b769350e5a6226e307f1042923e78360687a4256a35128826d36c147cf7f5f7c2e5ef750109baf768c96a9ebfea01efb0e56
-
C:\Users\Admin\AppData\Local\Temp\dpxyhbjguk.exeFilesize
4KB
MD5f3263d29b9c10c4e323227bd098740e8
SHA17ad4193558a06fa0d44315d6db40e620c440f1d3
SHA256629efdf63bd862d249b94fb80c1d5b4ceb43ee0f2be59ed0310c3cd92c162b0a
SHA5128fed273a8dc13f2e2eab1e90c099b769350e5a6226e307f1042923e78360687a4256a35128826d36c147cf7f5f7c2e5ef750109baf768c96a9ebfea01efb0e56
-
C:\Users\Public\vbc.exeFilesize
214KB
MD53f54e149af6d9802c9a03de4157c7621
SHA18ba2e29b8ef74315f335d7ca666ec56accd80d8d
SHA256cfa42383596eaed1eff9a35af295930c2e26615a12249041b5d291416d89c8a6
SHA5124f1401b2cac5d3dbda82ffc7c96151401578b3bb592b7b48caee5e362cb458a77b4e701816a3f88dc6db76c731dff53305d1430c6ab594940ac5706c211c0713
-
C:\Users\Public\vbc.exeFilesize
214KB
MD53f54e149af6d9802c9a03de4157c7621
SHA18ba2e29b8ef74315f335d7ca666ec56accd80d8d
SHA256cfa42383596eaed1eff9a35af295930c2e26615a12249041b5d291416d89c8a6
SHA5124f1401b2cac5d3dbda82ffc7c96151401578b3bb592b7b48caee5e362cb458a77b4e701816a3f88dc6db76c731dff53305d1430c6ab594940ac5706c211c0713
-
\Users\Admin\AppData\Local\Temp\dpxyhbjguk.exeFilesize
4KB
MD5f3263d29b9c10c4e323227bd098740e8
SHA17ad4193558a06fa0d44315d6db40e620c440f1d3
SHA256629efdf63bd862d249b94fb80c1d5b4ceb43ee0f2be59ed0310c3cd92c162b0a
SHA5128fed273a8dc13f2e2eab1e90c099b769350e5a6226e307f1042923e78360687a4256a35128826d36c147cf7f5f7c2e5ef750109baf768c96a9ebfea01efb0e56
-
\Users\Admin\AppData\Local\Temp\dpxyhbjguk.exeFilesize
4KB
MD5f3263d29b9c10c4e323227bd098740e8
SHA17ad4193558a06fa0d44315d6db40e620c440f1d3
SHA256629efdf63bd862d249b94fb80c1d5b4ceb43ee0f2be59ed0310c3cd92c162b0a
SHA5128fed273a8dc13f2e2eab1e90c099b769350e5a6226e307f1042923e78360687a4256a35128826d36c147cf7f5f7c2e5ef750109baf768c96a9ebfea01efb0e56
-
\Users\Public\vbc.exeFilesize
214KB
MD53f54e149af6d9802c9a03de4157c7621
SHA18ba2e29b8ef74315f335d7ca666ec56accd80d8d
SHA256cfa42383596eaed1eff9a35af295930c2e26615a12249041b5d291416d89c8a6
SHA5124f1401b2cac5d3dbda82ffc7c96151401578b3bb592b7b48caee5e362cb458a77b4e701816a3f88dc6db76c731dff53305d1430c6ab594940ac5706c211c0713
-
\Users\Public\vbc.exeFilesize
214KB
MD53f54e149af6d9802c9a03de4157c7621
SHA18ba2e29b8ef74315f335d7ca666ec56accd80d8d
SHA256cfa42383596eaed1eff9a35af295930c2e26615a12249041b5d291416d89c8a6
SHA5124f1401b2cac5d3dbda82ffc7c96151401578b3bb592b7b48caee5e362cb458a77b4e701816a3f88dc6db76c731dff53305d1430c6ab594940ac5706c211c0713
-
\Users\Public\vbc.exeFilesize
214KB
MD53f54e149af6d9802c9a03de4157c7621
SHA18ba2e29b8ef74315f335d7ca666ec56accd80d8d
SHA256cfa42383596eaed1eff9a35af295930c2e26615a12249041b5d291416d89c8a6
SHA5124f1401b2cac5d3dbda82ffc7c96151401578b3bb592b7b48caee5e362cb458a77b4e701816a3f88dc6db76c731dff53305d1430c6ab594940ac5706c211c0713
-
memory/1212-96-0x000007FF15D10000-0x000007FF15D1A000-memory.dmpFilesize
40KB
-
memory/1212-95-0x000007FEF6CD0000-0x000007FEF6E13000-memory.dmpFilesize
1.3MB
-
memory/1212-82-0x00000000062B0000-0x00000000063F8000-memory.dmpFilesize
1.3MB
-
memory/1212-93-0x0000000006400000-0x00000000064F3000-memory.dmpFilesize
972KB
-
memory/1212-85-0x0000000004E40000-0x0000000004F13000-memory.dmpFilesize
844KB
-
memory/1672-58-0x0000000075AE1000-0x0000000075AE3000-memory.dmpFilesize
8KB
-
memory/1672-57-0x0000000072BFD000-0x0000000072C08000-memory.dmpFilesize
44KB
-
memory/1672-56-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1672-55-0x0000000071C11000-0x0000000071C13000-memory.dmpFilesize
8KB
-
memory/1672-54-0x000000002F8D1000-0x000000002F8D4000-memory.dmpFilesize
12KB
-
memory/1672-94-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1700-63-0x0000000000000000-mapping.dmp
-
memory/1880-68-0x0000000000000000-mapping.dmp
-
memory/1884-90-0x0000000000090000-0x00000000000BF000-memory.dmpFilesize
188KB
-
memory/1884-86-0x0000000000000000-mapping.dmp
-
memory/1884-89-0x0000000000C10000-0x0000000000C28000-memory.dmpFilesize
96KB
-
memory/1884-91-0x0000000002030000-0x0000000002333000-memory.dmpFilesize
3.0MB
-
memory/1884-92-0x0000000000840000-0x00000000008D3000-memory.dmpFilesize
588KB
-
memory/1888-88-0x0000000000000000-mapping.dmp
-
memory/1960-81-0x00000000002C0000-0x00000000002D4000-memory.dmpFilesize
80KB
-
memory/1960-80-0x00000000006E0000-0x00000000009E3000-memory.dmpFilesize
3.0MB
-
memory/1960-79-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1960-75-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1960-76-0x000000000041F150-mapping.dmp
-
memory/1960-84-0x0000000000310000-0x0000000000324000-memory.dmpFilesize
80KB