Analysis
-
max time kernel
156s -
max time network
163s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
13-05-2022 14:33
Static task
static1
Behavioral task
behavioral1
Sample
SRL INJOUGH Oferty.xlsx
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
SRL INJOUGH Oferty.xlsx
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
decrypted.xlsx
Resource
win7-20220414-en
Behavioral task
behavioral4
Sample
decrypted.xlsx
Resource
win10v2004-20220414-en
General
-
Target
SRL INJOUGH Oferty.xlsx
-
Size
183KB
-
MD5
e2f9f7205237d66d1bf38afe6c640339
-
SHA1
8ca995164a3c4ef2e9bc5c95ee124872391deaa7
-
SHA256
48af10595cf68328465412bae7225b4c5da1f4394ddaa58735b15e062c502329
-
SHA512
ae47a6060cd11366865bc4f90c4203042f59f89dfbb57def54a1dcc5794f287233887b087802928672e76649525877f01587c85650274191730a935441cf9d1a
Malware Config
Extracted
xloader
2.6
arh2
hstorc.com
blackountry.com
dhrbakery.com
dezhouofit.com
defipayout.xyz
ginas4t.com
byzbh63.xyz
qrcrashview.com
mialibaby.com
enhaut.net
samainnova.com
yashveerresort.com
delfos.online
dungcumay.com
lj-counseling.net
fliptheswitch.pro
padogbitelawyer.com
aticarev.com
sederino.site
bestplansforpets-japan3.life
radicallysimplesupps.com
sandbagmaker.com
misdcf.xyz
nbpz.xyz
floridasunbreaks.com
justfinishesofcolorado.com
homemethtestkit.com
chaquetashapticas.com
zodiactshirt.com
tees.email
zxzx999.com
tempepdf.com
watchusroll.com
parotacenter.com
assistcourse.online
paulstilingroup.com
cnbcfx.com
mooncore.xyz
laplugnation.com
gosti24.com
cthomassolutions.com
rkhubs.com
aboutpier.com
multimediaroomandboard.com
iamparrot.com
wifitest.info
nounworld.com
xpartner.biz
128grandviewdrivenewportnsw.com
bakiin.com
suitcell.com
onehitgamerstudios.com
bathingsuitsshoppingus.com
wingstarifa.com
ccasudqi.com
epiconscious.com
ponponshoes.com
cicom.tech
safetynetinc.net
recanto.xyz
sellsidelite.net
kevmoinesproperties.com
hdwallpaperpics.life
57gznfw.xyz
abtys6.online
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
Xloader Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1976-75-0x0000000000400000-0x000000000042B000-memory.dmp xloader behavioral1/memory/1976-76-0x000000000041F270-mapping.dmp xloader behavioral1/memory/1976-79-0x0000000000400000-0x000000000042B000-memory.dmp xloader behavioral1/memory/268-86-0x00000000000D0000-0x00000000000FB000-memory.dmp xloader -
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 3 844 EQNEDT32.EXE -
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
vbc.exejcygjcnq.exejcygjcnq.exepid process 980 vbc.exe 1204 jcygjcnq.exe 1976 jcygjcnq.exe -
Loads dropped DLL 5 IoCs
Processes:
EQNEDT32.EXEvbc.exejcygjcnq.exepid process 844 EQNEDT32.EXE 844 EQNEDT32.EXE 844 EQNEDT32.EXE 980 vbc.exe 1204 jcygjcnq.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
jcygjcnq.exejcygjcnq.exewuapp.exedescription pid process target process PID 1204 set thread context of 1976 1204 jcygjcnq.exe jcygjcnq.exe PID 1976 set thread context of 1392 1976 jcygjcnq.exe Explorer.EXE PID 268 set thread context of 1392 268 wuapp.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
EXCEL.EXEdescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" EXCEL.EXE -
Modifies registry class 64 IoCs
Processes:
EXCEL.EXEdescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32 EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 860 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
jcygjcnq.exewuapp.exepid process 1976 jcygjcnq.exe 1976 jcygjcnq.exe 268 wuapp.exe 268 wuapp.exe 268 wuapp.exe 268 wuapp.exe 268 wuapp.exe 268 wuapp.exe 268 wuapp.exe 268 wuapp.exe 268 wuapp.exe 268 wuapp.exe 268 wuapp.exe 268 wuapp.exe 268 wuapp.exe 268 wuapp.exe 268 wuapp.exe 268 wuapp.exe 268 wuapp.exe 268 wuapp.exe 268 wuapp.exe 268 wuapp.exe 268 wuapp.exe 268 wuapp.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
jcygjcnq.exewuapp.exepid process 1976 jcygjcnq.exe 1976 jcygjcnq.exe 1976 jcygjcnq.exe 268 wuapp.exe 268 wuapp.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
jcygjcnq.exewuapp.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1976 jcygjcnq.exe Token: SeDebugPrivilege 268 wuapp.exe Token: SeShutdownPrivilege 1392 Explorer.EXE Token: SeShutdownPrivilege 1392 Explorer.EXE Token: SeShutdownPrivilege 1392 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1392 Explorer.EXE 1392 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1392 Explorer.EXE 1392 Explorer.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 860 EXCEL.EXE 860 EXCEL.EXE 860 EXCEL.EXE -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
EQNEDT32.EXEvbc.exejcygjcnq.exeExplorer.EXEwuapp.exedescription pid process target process PID 844 wrote to memory of 980 844 EQNEDT32.EXE vbc.exe PID 844 wrote to memory of 980 844 EQNEDT32.EXE vbc.exe PID 844 wrote to memory of 980 844 EQNEDT32.EXE vbc.exe PID 844 wrote to memory of 980 844 EQNEDT32.EXE vbc.exe PID 980 wrote to memory of 1204 980 vbc.exe jcygjcnq.exe PID 980 wrote to memory of 1204 980 vbc.exe jcygjcnq.exe PID 980 wrote to memory of 1204 980 vbc.exe jcygjcnq.exe PID 980 wrote to memory of 1204 980 vbc.exe jcygjcnq.exe PID 1204 wrote to memory of 1976 1204 jcygjcnq.exe jcygjcnq.exe PID 1204 wrote to memory of 1976 1204 jcygjcnq.exe jcygjcnq.exe PID 1204 wrote to memory of 1976 1204 jcygjcnq.exe jcygjcnq.exe PID 1204 wrote to memory of 1976 1204 jcygjcnq.exe jcygjcnq.exe PID 1204 wrote to memory of 1976 1204 jcygjcnq.exe jcygjcnq.exe PID 1204 wrote to memory of 1976 1204 jcygjcnq.exe jcygjcnq.exe PID 1204 wrote to memory of 1976 1204 jcygjcnq.exe jcygjcnq.exe PID 1392 wrote to memory of 268 1392 Explorer.EXE wuapp.exe PID 1392 wrote to memory of 268 1392 Explorer.EXE wuapp.exe PID 1392 wrote to memory of 268 1392 Explorer.EXE wuapp.exe PID 1392 wrote to memory of 268 1392 Explorer.EXE wuapp.exe PID 1392 wrote to memory of 268 1392 Explorer.EXE wuapp.exe PID 1392 wrote to memory of 268 1392 Explorer.EXE wuapp.exe PID 1392 wrote to memory of 268 1392 Explorer.EXE wuapp.exe PID 268 wrote to memory of 584 268 wuapp.exe cmd.exe PID 268 wrote to memory of 584 268 wuapp.exe cmd.exe PID 268 wrote to memory of 584 268 wuapp.exe cmd.exe PID 268 wrote to memory of 584 268 wuapp.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\SRL INJOUGH Oferty.xlsx"2⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:860 -
C:\Windows\SysWOW64\wuapp.exe"C:\Windows\SysWOW64\wuapp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:268 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\jcygjcnq.exe"3⤵PID:584
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Users\Admin\AppData\Local\Temp\jcygjcnq.exeC:\Users\Admin\AppData\Local\Temp\jcygjcnq.exe C:\Users\Admin\AppData\Local\Temp\qstzsxjbbv3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\jcygjcnq.exeC:\Users\Admin\AppData\Local\Temp\jcygjcnq.exe C:\Users\Admin\AppData\Local\Temp\qstzsxjbbv4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1976
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\jcygjcnq.exeFilesize
78KB
MD598ee6c5e1d885357154526d643b4126d
SHA1fe5f549d66395bca847aab1fae7588188cd56f33
SHA25605cf82c84a2879edc66f9fad43eb960ba84330ecc31f15e09ef0e08f86d57d90
SHA5123a7145dc85a426acbdb12cf340100de25059b2016609449961f23e5585bede18b4ab2d28f10656db0580e57651beda271d509c439d54907e35c3b3aab2101200
-
C:\Users\Admin\AppData\Local\Temp\jcygjcnq.exeFilesize
78KB
MD598ee6c5e1d885357154526d643b4126d
SHA1fe5f549d66395bca847aab1fae7588188cd56f33
SHA25605cf82c84a2879edc66f9fad43eb960ba84330ecc31f15e09ef0e08f86d57d90
SHA5123a7145dc85a426acbdb12cf340100de25059b2016609449961f23e5585bede18b4ab2d28f10656db0580e57651beda271d509c439d54907e35c3b3aab2101200
-
C:\Users\Admin\AppData\Local\Temp\jcygjcnq.exeFilesize
78KB
MD598ee6c5e1d885357154526d643b4126d
SHA1fe5f549d66395bca847aab1fae7588188cd56f33
SHA25605cf82c84a2879edc66f9fad43eb960ba84330ecc31f15e09ef0e08f86d57d90
SHA5123a7145dc85a426acbdb12cf340100de25059b2016609449961f23e5585bede18b4ab2d28f10656db0580e57651beda271d509c439d54907e35c3b3aab2101200
-
C:\Users\Admin\AppData\Local\Temp\qstzsxjbbvFilesize
5KB
MD581d4a4f84f4a44459833e2fa6e08458a
SHA161d47b45384e992edd0423242c8d1ec68aaff87c
SHA256772bb6e41de10b3520e6675da37648bf9cde3c83e48c42ae30882e13a8d985b9
SHA512a18514784af2be67b8b9b3d9bc676687b542c49543438836e76aea6736c3cfed1d72ad45ca55c492273459e0953ade833b5ee551b298af26dfebe6548ae2950e
-
C:\Users\Admin\AppData\Local\Temp\rlpvwtcgjf9e517nzq2zFilesize
171KB
MD5193aecc71e1ef6f8db44cc6305d6c5bc
SHA1311822f5303013ef51289572f1faf8d3699cbfaa
SHA2569fde97c4f96298defd74e263c9b32cecf2b62289ec4187c2a01643286da5c061
SHA512fdeff8db099a6b4dad4e13739c35efe03e6bd87c6541c557783d0479ce4cb24168c07e1dc9dab3efabe658165ef9b081ea6af997d7a1500900659a018b9835d8
-
C:\Users\Public\vbc.exeFilesize
257KB
MD5e437b563de87f3d825a87269e16fdd50
SHA1e6fe350f21bd3f3302e12e0d6670880c9ace9f9e
SHA2568f3780c613f03acb6ee57b161685fe6adfa77fe0f9571992f315b1477148c56e
SHA5129c2af78712edb27c36bf1ba3004e24ad63473c897217c7b8346118af279431d8e9301c7c0b9f9151a8157f05ba790d3e480f36308b09c42864bb2cac6f29dd12
-
C:\Users\Public\vbc.exeFilesize
257KB
MD5e437b563de87f3d825a87269e16fdd50
SHA1e6fe350f21bd3f3302e12e0d6670880c9ace9f9e
SHA2568f3780c613f03acb6ee57b161685fe6adfa77fe0f9571992f315b1477148c56e
SHA5129c2af78712edb27c36bf1ba3004e24ad63473c897217c7b8346118af279431d8e9301c7c0b9f9151a8157f05ba790d3e480f36308b09c42864bb2cac6f29dd12
-
\Users\Admin\AppData\Local\Temp\jcygjcnq.exeFilesize
78KB
MD598ee6c5e1d885357154526d643b4126d
SHA1fe5f549d66395bca847aab1fae7588188cd56f33
SHA25605cf82c84a2879edc66f9fad43eb960ba84330ecc31f15e09ef0e08f86d57d90
SHA5123a7145dc85a426acbdb12cf340100de25059b2016609449961f23e5585bede18b4ab2d28f10656db0580e57651beda271d509c439d54907e35c3b3aab2101200
-
\Users\Admin\AppData\Local\Temp\jcygjcnq.exeFilesize
78KB
MD598ee6c5e1d885357154526d643b4126d
SHA1fe5f549d66395bca847aab1fae7588188cd56f33
SHA25605cf82c84a2879edc66f9fad43eb960ba84330ecc31f15e09ef0e08f86d57d90
SHA5123a7145dc85a426acbdb12cf340100de25059b2016609449961f23e5585bede18b4ab2d28f10656db0580e57651beda271d509c439d54907e35c3b3aab2101200
-
\Users\Public\vbc.exeFilesize
257KB
MD5e437b563de87f3d825a87269e16fdd50
SHA1e6fe350f21bd3f3302e12e0d6670880c9ace9f9e
SHA2568f3780c613f03acb6ee57b161685fe6adfa77fe0f9571992f315b1477148c56e
SHA5129c2af78712edb27c36bf1ba3004e24ad63473c897217c7b8346118af279431d8e9301c7c0b9f9151a8157f05ba790d3e480f36308b09c42864bb2cac6f29dd12
-
\Users\Public\vbc.exeFilesize
257KB
MD5e437b563de87f3d825a87269e16fdd50
SHA1e6fe350f21bd3f3302e12e0d6670880c9ace9f9e
SHA2568f3780c613f03acb6ee57b161685fe6adfa77fe0f9571992f315b1477148c56e
SHA5129c2af78712edb27c36bf1ba3004e24ad63473c897217c7b8346118af279431d8e9301c7c0b9f9151a8157f05ba790d3e480f36308b09c42864bb2cac6f29dd12
-
\Users\Public\vbc.exeFilesize
257KB
MD5e437b563de87f3d825a87269e16fdd50
SHA1e6fe350f21bd3f3302e12e0d6670880c9ace9f9e
SHA2568f3780c613f03acb6ee57b161685fe6adfa77fe0f9571992f315b1477148c56e
SHA5129c2af78712edb27c36bf1ba3004e24ad63473c897217c7b8346118af279431d8e9301c7c0b9f9151a8157f05ba790d3e480f36308b09c42864bb2cac6f29dd12
-
memory/268-83-0x0000000000000000-mapping.dmp
-
memory/268-88-0x0000000000380000-0x0000000000410000-memory.dmpFilesize
576KB
-
memory/268-87-0x0000000000BC0000-0x0000000000EC3000-memory.dmpFilesize
3.0MB
-
memory/268-86-0x00000000000D0000-0x00000000000FB000-memory.dmpFilesize
172KB
-
memory/268-85-0x0000000001260000-0x000000000126B000-memory.dmpFilesize
44KB
-
memory/584-84-0x0000000000000000-mapping.dmp
-
memory/860-90-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/860-58-0x0000000074C81000-0x0000000074C83000-memory.dmpFilesize
8KB
-
memory/860-57-0x0000000071DFD000-0x0000000071E08000-memory.dmpFilesize
44KB
-
memory/860-56-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/860-54-0x000000002FD81000-0x000000002FD84000-memory.dmpFilesize
12KB
-
memory/860-55-0x0000000070E11000-0x0000000070E13000-memory.dmpFilesize
8KB
-
memory/980-63-0x0000000000000000-mapping.dmp
-
memory/1204-68-0x0000000000000000-mapping.dmp
-
memory/1392-82-0x00000000065D0000-0x0000000006756000-memory.dmpFilesize
1.5MB
-
memory/1392-89-0x00000000071F0000-0x000000000733D000-memory.dmpFilesize
1.3MB
-
memory/1976-80-0x0000000000BD0000-0x0000000000ED3000-memory.dmpFilesize
3.0MB
-
memory/1976-81-0x0000000000280000-0x0000000000291000-memory.dmpFilesize
68KB
-
memory/1976-79-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/1976-76-0x000000000041F270-mapping.dmp
-
memory/1976-75-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB