Analysis
-
max time kernel
146s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
05-05-2022 05:19
Static task
static1
Behavioral task
behavioral1
Sample
AWB_NO_9284730932.xlsx
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
AWB_NO_9284730932.xlsx
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
decrypted.xlsx
Resource
win7-20220414-en
Behavioral task
behavioral4
Sample
decrypted.xlsx
Resource
win10v2004-20220414-en
General
-
Target
AWB_NO_9284730932.xlsx
-
Size
206KB
-
MD5
5d7eb39dcf8fb650cf9a5cb7f3c66f89
-
SHA1
f73f4854f32b82851e6537758900541772c2181b
-
SHA256
5d81ecea3ddb68a54c0bfdf6a5da1061ce81f3abb559032bf4cf1c412423454d
-
SHA512
29621937e83117e08ac9d75148bcba58226c4b0d2ff3139af4e1b105862ed9ad5270fdb6fd353347ff48063edd15b6756402ae603bb72d1321c6a69565647b79
Malware Config
Extracted
formbook
4.1
fw02
payer-breakers.com
thesiscoper.com
rental-villa.com
scovikinnovations.com
hydh33.com
allmyshit.rest
lovejaclyn.com
vanessaruizwriting.com
dufonddelaclasse.com
kiddee168.com
monumentalmarketsllc.com
musclegainfatloss.com
avida.info
cosmo-wellness.net
dandelionfusedigital.com
oversizeloadbanners.com
konstelle.store
sdjnsbd.com
czoqg.xyz
5p6xljjse1lq.xyz
10936.loan
primeiropasso.website
salarydetector.net
the6figureshow.com
ritzluxurytransportation.com
5145.design
web3ido.xyz
starweaverdesigns.com
cbdtz.com
sunwall.xyz
ornitv.com
curateddesignsconsulting.com
businesshairways.biz
willacloud.com
accusecures.com
hl243.com
coffellc.icu
eddrugs2018.com
lidakang.xyz
salesstorecolombia.com
ilina.xyz
partieslikethese.com
peymantasnimi.com
datthocu.xyz
cybertechsolutions.xyz
findy.guru
trybes.space
arulinks.com
yuriookinoart.com
largestjerseysstore.com
fortitude-tech.com
ywfjp.com
b1v097f2avze.xyz
abdullahnazhim.com
zhaoav111.info
cegrowing.com
llaveselmuerto.com
7477e.xyz
chabusinessloans.com
ht-brain.com
app-compound.finance
0085208.com
wewinaccidents.com
ztzfirst.xyz
shishlomarket24.biz
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1968-74-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1968-75-0x000000000041F150-mapping.dmp formbook behavioral1/memory/1968-78-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1760-87-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 3 1332 EQNEDT32.EXE -
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
vbc.exerysgtozci.exerysgtozci.exepid process 816 vbc.exe 1496 rysgtozci.exe 1968 rysgtozci.exe -
Loads dropped DLL 5 IoCs
Processes:
EQNEDT32.EXEvbc.exerysgtozci.exepid process 1332 EQNEDT32.EXE 1332 EQNEDT32.EXE 1332 EQNEDT32.EXE 816 vbc.exe 1496 rysgtozci.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
rysgtozci.exerysgtozci.exeexplorer.exedescription pid process target process PID 1496 set thread context of 1968 1496 rysgtozci.exe rysgtozci.exe PID 1968 set thread context of 1360 1968 rysgtozci.exe Explorer.EXE PID 1760 set thread context of 1360 1760 explorer.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
EXCEL.EXEdescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE -
Modifies registry class 64 IoCs
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597} EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32 EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 856 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
rysgtozci.exeexplorer.exepid process 1968 rysgtozci.exe 1968 rysgtozci.exe 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
rysgtozci.exeexplorer.exepid process 1968 rysgtozci.exe 1968 rysgtozci.exe 1968 rysgtozci.exe 1760 explorer.exe 1760 explorer.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
rysgtozci.exeexplorer.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1968 rysgtozci.exe Token: SeDebugPrivilege 1760 explorer.exe Token: SeShutdownPrivilege 1360 Explorer.EXE Token: SeShutdownPrivilege 1360 Explorer.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 856 EXCEL.EXE 856 EXCEL.EXE 856 EXCEL.EXE -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
EQNEDT32.EXEvbc.exerysgtozci.exeExplorer.EXEexplorer.exedescription pid process target process PID 1332 wrote to memory of 816 1332 EQNEDT32.EXE vbc.exe PID 1332 wrote to memory of 816 1332 EQNEDT32.EXE vbc.exe PID 1332 wrote to memory of 816 1332 EQNEDT32.EXE vbc.exe PID 1332 wrote to memory of 816 1332 EQNEDT32.EXE vbc.exe PID 816 wrote to memory of 1496 816 vbc.exe rysgtozci.exe PID 816 wrote to memory of 1496 816 vbc.exe rysgtozci.exe PID 816 wrote to memory of 1496 816 vbc.exe rysgtozci.exe PID 816 wrote to memory of 1496 816 vbc.exe rysgtozci.exe PID 1496 wrote to memory of 1968 1496 rysgtozci.exe rysgtozci.exe PID 1496 wrote to memory of 1968 1496 rysgtozci.exe rysgtozci.exe PID 1496 wrote to memory of 1968 1496 rysgtozci.exe rysgtozci.exe PID 1496 wrote to memory of 1968 1496 rysgtozci.exe rysgtozci.exe PID 1496 wrote to memory of 1968 1496 rysgtozci.exe rysgtozci.exe PID 1496 wrote to memory of 1968 1496 rysgtozci.exe rysgtozci.exe PID 1496 wrote to memory of 1968 1496 rysgtozci.exe rysgtozci.exe PID 1360 wrote to memory of 1760 1360 Explorer.EXE explorer.exe PID 1360 wrote to memory of 1760 1360 Explorer.EXE explorer.exe PID 1360 wrote to memory of 1760 1360 Explorer.EXE explorer.exe PID 1360 wrote to memory of 1760 1360 Explorer.EXE explorer.exe PID 1760 wrote to memory of 812 1760 explorer.exe cmd.exe PID 1760 wrote to memory of 812 1760 explorer.exe cmd.exe PID 1760 wrote to memory of 812 1760 explorer.exe cmd.exe PID 1760 wrote to memory of 812 1760 explorer.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\AWB_NO_9284730932.xlsx2⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\rysgtozci.exe"3⤵
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rysgtozci.exeC:\Users\Admin\AppData\Local\Temp\rysgtozci.exe C:\Users\Admin\AppData\Local\Temp\wduqqtzg3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rysgtozci.exeC:\Users\Admin\AppData\Local\Temp\rysgtozci.exe C:\Users\Admin\AppData\Local\Temp\wduqqtzg4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ptcgl43g463vgbr58Filesize
184KB
MD5b5b1c1f4818202956b29108fb25dec20
SHA17e74a79237d3090b0dbac83b2c038d849fde6382
SHA256d0da793571aa99c98e2afca3be0f3d6850aabbacf2aca4eeab8013e4ebf77a67
SHA5128ecd3fe32528d30c76c47763db6723cd69d2d8842fefcc7b3f12599b4f4f546c5ad4bd5c3c604f666fde36fd168945303414d54cd709df56fe96d08bbfe063e2
-
C:\Users\Admin\AppData\Local\Temp\rysgtozci.exeFilesize
5KB
MD596b3c3b0f05b4cedf349797d7cb05627
SHA1b2d7084dcae06676c21d0ab393c60d6480e1d03f
SHA256874f73e2673462859967afc64c3c33c1957d7b69915124cca91ced26dcfcd5c0
SHA512e264e979679a7dcd410b2916ec16f8333cba6a45d59faad99c9a45ff75d0e574d6ecbb52fb21a7b89732a8236b5f5416fd8fcffb595692f451dd6556b9641e73
-
C:\Users\Admin\AppData\Local\Temp\rysgtozci.exeFilesize
5KB
MD596b3c3b0f05b4cedf349797d7cb05627
SHA1b2d7084dcae06676c21d0ab393c60d6480e1d03f
SHA256874f73e2673462859967afc64c3c33c1957d7b69915124cca91ced26dcfcd5c0
SHA512e264e979679a7dcd410b2916ec16f8333cba6a45d59faad99c9a45ff75d0e574d6ecbb52fb21a7b89732a8236b5f5416fd8fcffb595692f451dd6556b9641e73
-
C:\Users\Admin\AppData\Local\Temp\rysgtozci.exeFilesize
5KB
MD596b3c3b0f05b4cedf349797d7cb05627
SHA1b2d7084dcae06676c21d0ab393c60d6480e1d03f
SHA256874f73e2673462859967afc64c3c33c1957d7b69915124cca91ced26dcfcd5c0
SHA512e264e979679a7dcd410b2916ec16f8333cba6a45d59faad99c9a45ff75d0e574d6ecbb52fb21a7b89732a8236b5f5416fd8fcffb595692f451dd6556b9641e73
-
C:\Users\Admin\AppData\Local\Temp\wduqqtzgFilesize
5KB
MD5cea27fda9443dd5882439188c2494a7b
SHA189b7f9c46c4462f37ee6e91d639ccdd3084e03cd
SHA25626a0ef0fe1fdab9e6dae3caecec085c3800a44d32cd5b87c182c0c0a6b559f59
SHA51212040c4009e23ec2d4cf15a9f5b31587070f6086f2816efeb946a6d2f1609339ba66a8639f187d2ac97d0284264df7aee0f62b40ea550567b5e35f66992a1c87
-
C:\Users\Public\vbc.exeFilesize
214KB
MD55fc986129c3d833b1c7e5ba6ff3678bc
SHA12ace6bc0488df9b8592e25be3de38e6c9a0c16da
SHA256d02d076842cc94fa6612b13ff0d2f77e1ff9150d22607cfe3962da4234cf4ed5
SHA5127f496926ea5026eda78532c001ce21e6f9f6ec4474ee995909a53f106def291cd7338072e56b29b7844ea43dc83fcd3eb6f8e36d2db5d8d5e0281059d60f9043
-
C:\Users\Public\vbc.exeFilesize
214KB
MD55fc986129c3d833b1c7e5ba6ff3678bc
SHA12ace6bc0488df9b8592e25be3de38e6c9a0c16da
SHA256d02d076842cc94fa6612b13ff0d2f77e1ff9150d22607cfe3962da4234cf4ed5
SHA5127f496926ea5026eda78532c001ce21e6f9f6ec4474ee995909a53f106def291cd7338072e56b29b7844ea43dc83fcd3eb6f8e36d2db5d8d5e0281059d60f9043
-
\Users\Admin\AppData\Local\Temp\rysgtozci.exeFilesize
5KB
MD596b3c3b0f05b4cedf349797d7cb05627
SHA1b2d7084dcae06676c21d0ab393c60d6480e1d03f
SHA256874f73e2673462859967afc64c3c33c1957d7b69915124cca91ced26dcfcd5c0
SHA512e264e979679a7dcd410b2916ec16f8333cba6a45d59faad99c9a45ff75d0e574d6ecbb52fb21a7b89732a8236b5f5416fd8fcffb595692f451dd6556b9641e73
-
\Users\Admin\AppData\Local\Temp\rysgtozci.exeFilesize
5KB
MD596b3c3b0f05b4cedf349797d7cb05627
SHA1b2d7084dcae06676c21d0ab393c60d6480e1d03f
SHA256874f73e2673462859967afc64c3c33c1957d7b69915124cca91ced26dcfcd5c0
SHA512e264e979679a7dcd410b2916ec16f8333cba6a45d59faad99c9a45ff75d0e574d6ecbb52fb21a7b89732a8236b5f5416fd8fcffb595692f451dd6556b9641e73
-
\Users\Public\vbc.exeFilesize
214KB
MD55fc986129c3d833b1c7e5ba6ff3678bc
SHA12ace6bc0488df9b8592e25be3de38e6c9a0c16da
SHA256d02d076842cc94fa6612b13ff0d2f77e1ff9150d22607cfe3962da4234cf4ed5
SHA5127f496926ea5026eda78532c001ce21e6f9f6ec4474ee995909a53f106def291cd7338072e56b29b7844ea43dc83fcd3eb6f8e36d2db5d8d5e0281059d60f9043
-
\Users\Public\vbc.exeFilesize
214KB
MD55fc986129c3d833b1c7e5ba6ff3678bc
SHA12ace6bc0488df9b8592e25be3de38e6c9a0c16da
SHA256d02d076842cc94fa6612b13ff0d2f77e1ff9150d22607cfe3962da4234cf4ed5
SHA5127f496926ea5026eda78532c001ce21e6f9f6ec4474ee995909a53f106def291cd7338072e56b29b7844ea43dc83fcd3eb6f8e36d2db5d8d5e0281059d60f9043
-
\Users\Public\vbc.exeFilesize
214KB
MD55fc986129c3d833b1c7e5ba6ff3678bc
SHA12ace6bc0488df9b8592e25be3de38e6c9a0c16da
SHA256d02d076842cc94fa6612b13ff0d2f77e1ff9150d22607cfe3962da4234cf4ed5
SHA5127f496926ea5026eda78532c001ce21e6f9f6ec4474ee995909a53f106def291cd7338072e56b29b7844ea43dc83fcd3eb6f8e36d2db5d8d5e0281059d60f9043
-
memory/812-85-0x0000000000000000-mapping.dmp
-
memory/816-63-0x0000000000000000-mapping.dmp
-
memory/856-55-0x00000000713C1000-0x00000000713C3000-memory.dmpFilesize
8KB
-
memory/856-54-0x000000002F431000-0x000000002F434000-memory.dmpFilesize
12KB
-
memory/856-58-0x0000000076191000-0x0000000076193000-memory.dmpFilesize
8KB
-
memory/856-57-0x00000000723AD000-0x00000000723B8000-memory.dmpFilesize
44KB
-
memory/856-91-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/856-56-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1360-81-0x0000000006DB0000-0x0000000006F46000-memory.dmpFilesize
1.6MB
-
memory/1360-90-0x0000000006F50000-0x00000000070AC000-memory.dmpFilesize
1.4MB
-
memory/1496-68-0x0000000000000000-mapping.dmp
-
memory/1760-88-0x00000000022F0000-0x00000000025F3000-memory.dmpFilesize
3.0MB
-
memory/1760-82-0x0000000000000000-mapping.dmp
-
memory/1760-84-0x000000006C861000-0x000000006C863000-memory.dmpFilesize
8KB
-
memory/1760-86-0x00000000005E0000-0x0000000000861000-memory.dmpFilesize
2.5MB
-
memory/1760-87-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/1760-89-0x0000000002020000-0x00000000020B3000-memory.dmpFilesize
588KB
-
memory/1968-80-0x00000000002C0000-0x00000000002D4000-memory.dmpFilesize
80KB
-
memory/1968-75-0x000000000041F150-mapping.dmp
-
memory/1968-78-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1968-79-0x0000000000920000-0x0000000000C23000-memory.dmpFilesize
3.0MB
-
memory/1968-74-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB