Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
11-05-2022 09:00
Static task
static1
Behavioral task
behavioral1
Sample
Berthing.xlsx
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Berthing.xlsx
Resource
win10v2004-20220414-en
General
-
Target
Berthing.xlsx
-
Size
131KB
-
MD5
95b1b15c87f5d6daba1c72e6514a9fc1
-
SHA1
4f05f44baf5d8d3e31dc050c79f1d8703c82e0be
-
SHA256
719ac8462a554ec46d13e7c3b33c39248d546da6e9618edec381656472814352
-
SHA512
bf1f39e08e3baeabc034145b9ec04b56787ee80d9c408d89368b88f6e0a5508e94d3921e1887efd47988f8e0d275530c854095d4d19861221a9cc939776afad4
Malware Config
Extracted
xloader
2.5
bs8f
atmospheraglobal.com
dontshootima.com
bestofferusde.club
yourdigitalboss.com
breskizci.com
myarrovacoastwebsite.com
reasclerk.com
efrovida.com
wsmz.net
upneett.com
loefflerforgov.com
noida.info
trndystore.com
arhaldar.online
vivibanca.tech
mykrema.com
vseserialy.online
ridgewayinsua.com
heauxland.com
bestcollegecourses.com
scent-kart.xyz
handyman-prime.com
wrightpurpose.com
hellounio.com
wealthy-link-erp.com
josegal.com
texasdominionrealty.com
hespresso.net
dreamonetnpasumo5.xyz
videosmind.com
abbawaalema.quest
esmtoluca.com
2382108759.com
akbastionoffilamentousfungi.com
electramanpower.com
siguealpanda.com
alquilerfurgon.com
3-little-pigs.com
esolutions4u.com
thatgolfer.com
biom4rk.com
paramusapartments.com
mothergadgets.com
ktnreport.xyz
amxdrivers.com
buymyhomeallcash.com
lifeisthere.com
nous-citoyens.com
destimarketing.com
lawinepro.com
littlenorwayfarmhouse.com
realworldgb488.rest
qualinorm.com
capitaltechcorp.com
familybeautifull.com
continentaldeal.com
scratchforce.com
veganbreathing.com
hickoryfalls-pm.com
pascal-rocha.com
20kretirementplan.biz
lehome.store
hellanatural.com
hnythao.com
gnizdo.online
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/688-74-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/688-75-0x000000000041D440-mapping.dmp xloader behavioral1/memory/688-78-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1488-90-0x0000000000110000-0x0000000000139000-memory.dmp xloader -
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 3 2032 EQNEDT32.EXE -
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
vbc.exetvvmynz.exetvvmynz.exepid process 2028 vbc.exe 1440 tvvmynz.exe 688 tvvmynz.exe -
Loads dropped DLL 4 IoCs
Processes:
EQNEDT32.EXEvbc.exetvvmynz.exepid process 2032 EQNEDT32.EXE 2028 vbc.exe 2028 vbc.exe 1440 tvvmynz.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 4 IoCs
Processes:
tvvmynz.exetvvmynz.exeexplorer.exedescription pid process target process PID 1440 set thread context of 688 1440 tvvmynz.exe tvvmynz.exe PID 688 set thread context of 1272 688 tvvmynz.exe Explorer.EXE PID 688 set thread context of 1272 688 tvvmynz.exe Explorer.EXE PID 1488 set thread context of 1272 1488 explorer.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE -
Modifies registry class 64 IoCs
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597} EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1648 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
tvvmynz.exeexplorer.exepid process 688 tvvmynz.exe 688 tvvmynz.exe 688 tvvmynz.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe 1488 explorer.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
tvvmynz.exeexplorer.exepid process 688 tvvmynz.exe 688 tvvmynz.exe 688 tvvmynz.exe 688 tvvmynz.exe 1488 explorer.exe 1488 explorer.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
tvvmynz.exeExplorer.EXEexplorer.exedescription pid process Token: SeDebugPrivilege 688 tvvmynz.exe Token: SeShutdownPrivilege 1272 Explorer.EXE Token: SeDebugPrivilege 1488 explorer.exe Token: SeShutdownPrivilege 1272 Explorer.EXE Token: SeShutdownPrivilege 1272 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1272 Explorer.EXE 1272 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1272 Explorer.EXE 1272 Explorer.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1648 EXCEL.EXE 1648 EXCEL.EXE 1648 EXCEL.EXE -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
EQNEDT32.EXEvbc.exetvvmynz.exetvvmynz.exeexplorer.exedescription pid process target process PID 2032 wrote to memory of 2028 2032 EQNEDT32.EXE vbc.exe PID 2032 wrote to memory of 2028 2032 EQNEDT32.EXE vbc.exe PID 2032 wrote to memory of 2028 2032 EQNEDT32.EXE vbc.exe PID 2032 wrote to memory of 2028 2032 EQNEDT32.EXE vbc.exe PID 2028 wrote to memory of 1440 2028 vbc.exe tvvmynz.exe PID 2028 wrote to memory of 1440 2028 vbc.exe tvvmynz.exe PID 2028 wrote to memory of 1440 2028 vbc.exe tvvmynz.exe PID 2028 wrote to memory of 1440 2028 vbc.exe tvvmynz.exe PID 1440 wrote to memory of 688 1440 tvvmynz.exe tvvmynz.exe PID 1440 wrote to memory of 688 1440 tvvmynz.exe tvvmynz.exe PID 1440 wrote to memory of 688 1440 tvvmynz.exe tvvmynz.exe PID 1440 wrote to memory of 688 1440 tvvmynz.exe tvvmynz.exe PID 1440 wrote to memory of 688 1440 tvvmynz.exe tvvmynz.exe PID 1440 wrote to memory of 688 1440 tvvmynz.exe tvvmynz.exe PID 1440 wrote to memory of 688 1440 tvvmynz.exe tvvmynz.exe PID 688 wrote to memory of 1488 688 tvvmynz.exe explorer.exe PID 688 wrote to memory of 1488 688 tvvmynz.exe explorer.exe PID 688 wrote to memory of 1488 688 tvvmynz.exe explorer.exe PID 688 wrote to memory of 1488 688 tvvmynz.exe explorer.exe PID 1488 wrote to memory of 1456 1488 explorer.exe cmd.exe PID 1488 wrote to memory of 1456 1488 explorer.exe cmd.exe PID 1488 wrote to memory of 1456 1488 explorer.exe cmd.exe PID 1488 wrote to memory of 1456 1488 explorer.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\Berthing.xlsx2⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tvvmynz.exeC:\Users\Admin\AppData\Local\Temp\tvvmynz.exe C:\Users\Admin\AppData\Local\Temp\ckxzkd3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tvvmynz.exeC:\Users\Admin\AppData\Local\Temp\tvvmynz.exe C:\Users\Admin\AppData\Local\Temp\ckxzkd4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"5⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\tvvmynz.exe"6⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ckxzkdFilesize
5KB
MD53bbf7ce478d3fea692aa6297cb2e4dc2
SHA1c275088b575650db8dab910a6a74250af7281d92
SHA256897ee822be5e7b5275567f42eee4c12f27435506459624534366c6fdf2057f4d
SHA5123d5c4b91afcb5cba9533c539d90db29a33bd6d36eab526f1ed39b53af1a3498d5485bd8902229505640466d5747ff5ea5b55cc03c32b8238e042635fd4939373
-
C:\Users\Admin\AppData\Local\Temp\o1bnmup7v5rcbjh1kpFilesize
163KB
MD56c9d820dbd568110130eae24b6d15162
SHA1ef796a5ce97a6cb202d670d643a5434a2f954711
SHA256c5db70e6f1cee701b3abf0454fc4a5b2ca17b01cba754df424e358e82e1c556e
SHA51244a1eaf1d7a3dc32604e8d4ae91f961f97969ce290628d4731e1cf06ab08d189dcd9c24e1fd0991eb79cb22dc7a48673c51f6a882ebf445201adff7adbf08ed7
-
C:\Users\Admin\AppData\Local\Temp\tvvmynz.exeFilesize
74KB
MD5e0e6d4282fbe8ee2df6df6fadc97cc21
SHA1e77ba45ce19ffaf6b240cd3468cafdc9ec41c290
SHA25641c7b15b38adfcf3d004c2cc3bb57abafa2ce3b9fbcf8eaa0691887494e1ec8c
SHA512766bbe241849234c42eab68c6f5f2dd131a9adb351924cd879de412f9c6b2ef01672508221b71f3d3a41a1a9a4b816db2f4947af38ed4523fa634967d6d82520
-
C:\Users\Admin\AppData\Local\Temp\tvvmynz.exeFilesize
74KB
MD5e0e6d4282fbe8ee2df6df6fadc97cc21
SHA1e77ba45ce19ffaf6b240cd3468cafdc9ec41c290
SHA25641c7b15b38adfcf3d004c2cc3bb57abafa2ce3b9fbcf8eaa0691887494e1ec8c
SHA512766bbe241849234c42eab68c6f5f2dd131a9adb351924cd879de412f9c6b2ef01672508221b71f3d3a41a1a9a4b816db2f4947af38ed4523fa634967d6d82520
-
C:\Users\Admin\AppData\Local\Temp\tvvmynz.exeFilesize
74KB
MD5e0e6d4282fbe8ee2df6df6fadc97cc21
SHA1e77ba45ce19ffaf6b240cd3468cafdc9ec41c290
SHA25641c7b15b38adfcf3d004c2cc3bb57abafa2ce3b9fbcf8eaa0691887494e1ec8c
SHA512766bbe241849234c42eab68c6f5f2dd131a9adb351924cd879de412f9c6b2ef01672508221b71f3d3a41a1a9a4b816db2f4947af38ed4523fa634967d6d82520
-
C:\Users\Public\vbc.exeFilesize
245KB
MD5af8e2192f8e67182761b3e533d017af7
SHA1e9a55a5e8cc2cdc571b965f0719a9e92bd749f21
SHA25640fbb07da69abd2e9af76579e314905103c73059c02b77c74adf81ab97eaa099
SHA512fca4e22f5969a725edaa378ff2d2bc3f83da73fc6c79259f5de15f39bb111f45440e54b352a3a6d2cd69f3a3d04b504c0ca9651108af3c2e9a83e83b60317aba
-
C:\Users\Public\vbc.exeFilesize
245KB
MD5af8e2192f8e67182761b3e533d017af7
SHA1e9a55a5e8cc2cdc571b965f0719a9e92bd749f21
SHA25640fbb07da69abd2e9af76579e314905103c73059c02b77c74adf81ab97eaa099
SHA512fca4e22f5969a725edaa378ff2d2bc3f83da73fc6c79259f5de15f39bb111f45440e54b352a3a6d2cd69f3a3d04b504c0ca9651108af3c2e9a83e83b60317aba
-
\Users\Admin\AppData\Local\Temp\tvvmynz.exeFilesize
74KB
MD5e0e6d4282fbe8ee2df6df6fadc97cc21
SHA1e77ba45ce19ffaf6b240cd3468cafdc9ec41c290
SHA25641c7b15b38adfcf3d004c2cc3bb57abafa2ce3b9fbcf8eaa0691887494e1ec8c
SHA512766bbe241849234c42eab68c6f5f2dd131a9adb351924cd879de412f9c6b2ef01672508221b71f3d3a41a1a9a4b816db2f4947af38ed4523fa634967d6d82520
-
\Users\Admin\AppData\Local\Temp\tvvmynz.exeFilesize
74KB
MD5e0e6d4282fbe8ee2df6df6fadc97cc21
SHA1e77ba45ce19ffaf6b240cd3468cafdc9ec41c290
SHA25641c7b15b38adfcf3d004c2cc3bb57abafa2ce3b9fbcf8eaa0691887494e1ec8c
SHA512766bbe241849234c42eab68c6f5f2dd131a9adb351924cd879de412f9c6b2ef01672508221b71f3d3a41a1a9a4b816db2f4947af38ed4523fa634967d6d82520
-
\Users\Admin\AppData\Local\Temp\tvvmynz.exeFilesize
74KB
MD5e0e6d4282fbe8ee2df6df6fadc97cc21
SHA1e77ba45ce19ffaf6b240cd3468cafdc9ec41c290
SHA25641c7b15b38adfcf3d004c2cc3bb57abafa2ce3b9fbcf8eaa0691887494e1ec8c
SHA512766bbe241849234c42eab68c6f5f2dd131a9adb351924cd879de412f9c6b2ef01672508221b71f3d3a41a1a9a4b816db2f4947af38ed4523fa634967d6d82520
-
\Users\Public\vbc.exeFilesize
245KB
MD5af8e2192f8e67182761b3e533d017af7
SHA1e9a55a5e8cc2cdc571b965f0719a9e92bd749f21
SHA25640fbb07da69abd2e9af76579e314905103c73059c02b77c74adf81ab97eaa099
SHA512fca4e22f5969a725edaa378ff2d2bc3f83da73fc6c79259f5de15f39bb111f45440e54b352a3a6d2cd69f3a3d04b504c0ca9651108af3c2e9a83e83b60317aba
-
memory/688-83-0x00000000022E0000-0x00000000022F1000-memory.dmpFilesize
68KB
-
memory/688-81-0x0000000000570000-0x0000000000581000-memory.dmpFilesize
68KB
-
memory/688-74-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/688-80-0x0000000000700000-0x0000000000A03000-memory.dmpFilesize
3.0MB
-
memory/688-75-0x000000000041D440-mapping.dmp
-
memory/688-78-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1272-79-0x0000000006FC0000-0x0000000007168000-memory.dmpFilesize
1.7MB
-
memory/1272-93-0x0000000008E10000-0x0000000008F0B000-memory.dmpFilesize
1004KB
-
memory/1272-84-0x0000000007170000-0x00000000072A6000-memory.dmpFilesize
1.2MB
-
memory/1440-67-0x0000000000000000-mapping.dmp
-
memory/1456-88-0x0000000000000000-mapping.dmp
-
memory/1488-90-0x0000000000110000-0x0000000000139000-memory.dmpFilesize
164KB
-
memory/1488-92-0x0000000002140000-0x00000000021D0000-memory.dmpFilesize
576KB
-
memory/1488-91-0x0000000002330000-0x0000000002633000-memory.dmpFilesize
3.0MB
-
memory/1488-89-0x00000000008D0000-0x0000000000B51000-memory.dmpFilesize
2.5MB
-
memory/1488-85-0x0000000000000000-mapping.dmp
-
memory/1488-87-0x000000006BEE1000-0x000000006BEE3000-memory.dmpFilesize
8KB
-
memory/1648-57-0x0000000071F7D000-0x0000000071F88000-memory.dmpFilesize
44KB
-
memory/1648-55-0x0000000070F91000-0x0000000070F93000-memory.dmpFilesize
8KB
-
memory/1648-56-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1648-54-0x000000002F551000-0x000000002F554000-memory.dmpFilesize
12KB
-
memory/1648-58-0x0000000075BA1000-0x0000000075BA3000-memory.dmpFilesize
8KB
-
memory/1648-94-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/2028-61-0x0000000000000000-mapping.dmp