Analysis
- max time kernel
147s - max time network
151s - platform
windows7_x64 - resource
win7-20220414-en - submitted
07/06/2022, 06:32
Static task
static1
Behavioral task
behavioral1
Sample
Rech 2022.06.06_0916.xls
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
- Target Rech 2022.06.06_0916.xls
- Size 70KB
- Sample220607-hal8vabfe9
- SHA256 e195f517c48aa10fb9332be7d763b9e4cea5118509c210c32375713e52f761df
- MD5 219f4b2b10d6bc62e615c5b4df79c545
- SHA1 9cfd43ab2fba9a9ae72653e727b887d16dfd6609
- SHA512 a027e06c2bdd55c8ddb696acdea78b858423f262439928171862f7332f73890e4248523513ac0f880dbabd44fbf82fd0a637c2888b690c9c330370171e3d20cb
- MD5 SHA1 SHA512
Malware Config
Extracted
Language
-
xlm4.0
Source
URLs
-
xlm40.dropper
http://nationco-op.org/css/8wv7lB5/
-
xlm40.dropper
http://lightmyfire.in/demo/RIkAFgTFVuaI05r2/
-
xlm40.dropper
http://www.nexxdecor.vn/apk/zy8GkZ/
Extracted
Family
-
emotet
Botnet
-
Epoch4
C2
-
94.23.45.86:4143
-
129.232.188.93:443
-
213.241.20.155:443
-
197.242.150.244:8080
-
172.104.251.154:8080
-
46.55.222.11:443
-
82.223.21.224:8080
-
5.9.116.246:8080
-
1.234.2.232:8080
-
146.59.226.45:443
-
160.16.142.56:8080
-
115.68.227.76:8080
-
72.15.201.15:8080
-
188.44.20.25:443
-
185.4.135.165:8080
-
103.132.242.26:8080
-
173.212.193.249:8080
-
163.44.196.120:8080
-
183.111.227.137:8080
-
149.56.131.28:8080
-
212.24.98.99:8080
-
159.65.140.115:443
-
150.95.66.124:8080
-
107.170.39.149:8080
-
203.114.109.124:443
-
41.73.252.195:443
-
37.187.115.122:8080
-
82.165.152.127:8080
-
119.193.124.41:7080
-
103.75.201.2:443
-
79.137.35.198:8080
-
159.65.88.10:8080
-
209.126.98.206:8080
-
167.172.253.162:8080
-
186.194.240.217:443
-
51.254.140.238:7080
-
51.91.76.89:8080
-
153.126.146.25:7080
-
207.180.241.186:8080
-
206.189.28.199:8080
-
45.176.232.124:443
-
103.70.28.102:8080
-
158.69.222.101:443
-
151.106.112.196:8080
-
103.43.75.120:443
-
91.207.28.33:8080
-
159.89.202.34:443
-
45.186.16.18:443
-
45.235.8.30:8080
-
201.94.166.162:443
-
164.68.99.3:8080
-
110.232.117.186:8080
-
45.118.115.99:8080
-
207.148.79.14:8080
-
131.100.24.231:80
-
31.22.4.160:8080
-
134.122.66.193:8080
-
196.218.30.83:443
-
209.97.163.214:443
-
1.234.21.73:7080
-
101.50.0.91:8080
eck1.plain
eck1.plain
Signatures
- Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1768 1472 regsvr32.exe 25 Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1668 1472 regsvr32.exe 25 Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1964 1472 regsvr32.exe 25 - suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
- Downloads MZ/PE file
- Loads dropped DLL 4 IoCs
pid Process 1668 regsvr32.exe 316 regsvr32.exe 1964 regsvr32.exe 1720 regsvr32.exe - Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE - Modifies registry class 64 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\"" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1472 EXCEL.EXE - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 316 regsvr32.exe 1376 regsvr32.exe 1376 regsvr32.exe 1720 regsvr32.exe 1520 regsvr32.exe 1520 regsvr32.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1472 EXCEL.EXE 1472 EXCEL.EXE 1472 EXCEL.EXE - Suspicious use of WriteProcessMemory 45 IoCs
description pid Process procid_target PID 1472 wrote to memory of 1768 1472 EXCEL.EXE 28 PID 1472 wrote to memory of 1768 1472 EXCEL.EXE 28 PID 1472 wrote to memory of 1768 1472 EXCEL.EXE 28 PID 1472 wrote to memory of 1768 1472 EXCEL.EXE 28 PID 1472 wrote to memory of 1768 1472 EXCEL.EXE 28 PID 1472 wrote to memory of 1768 1472 EXCEL.EXE 28 PID 1472 wrote to memory of 1768 1472 EXCEL.EXE 28 PID 1472 wrote to memory of 1668 1472 EXCEL.EXE 29 PID 1472 wrote to memory of 1668 1472 EXCEL.EXE 29 PID 1472 wrote to memory of 1668 1472 EXCEL.EXE 29 PID 1472 wrote to memory of 1668 1472 EXCEL.EXE 29 PID 1472 wrote to memory of 1668 1472 EXCEL.EXE 29 PID 1472 wrote to memory of 1668 1472 EXCEL.EXE 29 PID 1472 wrote to memory of 1668 1472 EXCEL.EXE 29 PID 1668 wrote to memory of 316 1668 regsvr32.exe 30 PID 1668 wrote to memory of 316 1668 regsvr32.exe 30 PID 1668 wrote to memory of 316 1668 regsvr32.exe 30 PID 1668 wrote to memory of 316 1668 regsvr32.exe 30 PID 1668 wrote to memory of 316 1668 regsvr32.exe 30 PID 1668 wrote to memory of 316 1668 regsvr32.exe 30 PID 1668 wrote to memory of 316 1668 regsvr32.exe 30 PID 316 wrote to memory of 1376 316 regsvr32.exe 31 PID 316 wrote to memory of 1376 316 regsvr32.exe 31 PID 316 wrote to memory of 1376 316 regsvr32.exe 31 PID 316 wrote to memory of 1376 316 regsvr32.exe 31 PID 316 wrote to memory of 1376 316 regsvr32.exe 31 PID 1472 wrote to memory of 1964 1472 EXCEL.EXE 32 PID 1472 wrote to memory of 1964 1472 EXCEL.EXE 32 PID 1472 wrote to memory of 1964 1472 EXCEL.EXE 32 PID 1472 wrote to memory of 1964 1472 EXCEL.EXE 32 PID 1472 wrote to memory of 1964 1472 EXCEL.EXE 32 PID 1472 wrote to memory of 1964 1472 EXCEL.EXE 32 PID 1472 wrote to memory of 1964 1472 EXCEL.EXE 32 PID 1964 wrote to memory of 1720 1964 regsvr32.exe 33 PID 1964 wrote to memory of 1720 1964 regsvr32.exe 33 PID 1964 wrote to memory of 1720 1964 regsvr32.exe 33 PID 1964 wrote to memory of 1720 1964 regsvr32.exe 33 PID 1964 wrote to memory of 1720 1964 regsvr32.exe 33 PID 1964 wrote to memory of 1720 1964 regsvr32.exe 33 PID 1964 wrote to memory of 1720 1964 regsvr32.exe 33 PID 1720 wrote to memory of 1520 1720 regsvr32.exe 34 PID 1720 wrote to memory of 1520 1720 regsvr32.exe 34 PID 1720 wrote to memory of 1520 1720 regsvr32.exe 34 PID 1720 wrote to memory of 1520 1720 regsvr32.exe 34 PID 1720 wrote to memory of 1520 1720 regsvr32.exe 34
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\Rech 2022.06.06_0916.xls"1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\dxgxe1.ocx2⤵
- Process spawned unexpected child process
PID:1768
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\dxgxe2.ocx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\system32\regsvr32.exe/S ..\dxgxe2.ocx3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\OAaBGC\IsyxYvl.dll"4⤵
- Suspicious behavior: EnumeratesProcesses
PID:1376
-
-
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\dxgxe3.ocx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\system32\regsvr32.exe/S ..\dxgxe3.ocx3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\UokEER\gSSWqvPyl.dll"4⤵
- Suspicious behavior: EnumeratesProcesses
PID:1520
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- Size 60KB
- SHA256 889b832323726a9f10ad03f85562048fdcfe20c9ff6f9d37412cf477b4e92ff9
- MD5 308336e7f515478969b24c13ded11ede
- SHA1 8fb0cf42b77dbbef224a1e5fc38abc2486320775
- SHA512 61ad97228cd6c3909ef3ac5e4940199971f293bdd0d5eb7916e60469573a44b6287c0fa1e0b6c1389df35eb6c9a7d2a61fdb318d4a886a3821ef5a9dab3ac24f
- SSDEEP 1536:NATLwfiuePkACih0/8uIwf5CiqGLhk1V/AFnGegJR:N7nePk5gKsoBha/0GTf
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 f56004e8ebabfce144addfc803d92f4e05a7f9d2ab229284e78a6f44687b6fea
- MD5 c1777e7f26116aa691273cebb65f8b5a
- SHA1 a550455b0e746e56e0a7f81a9d9428c99fd9b8df
- SHA512 d100771369a30880c4bf4584d024ebd3b0bc2ea2590eebe2739f252725e038e66cf95727cf5281fbaace27cfa754446df878fa910b8668e5239cc6bb6dd47b59
- MD5 SHA1 SHA512
- Path C:\Users\Admin\dxgxe2.ocx
- Size 665KB
- SHA256 40c46278d656be674b0fd733c3fbabb4edded7a2446f8ced62f7c7da1aeafb11
- MD5 efcd33bf4b68c4a102b69c9a4b1e9a35
- SHA1 06f46a7576af7c60aa87accf00904043aff990d6
- SHA512 6a8fcf240fe048d953e9c83d471e6b97b7e83a0bd5d86c9a3f9a0fd9da798bba4afa3a508e39b6bef795472cc6d12bd312a4626693fe671530af3d1d3c74bfaa
- SSDEEP 12288:IkcciVL7KJ39aFUl29UrVNVWgdblGaIsyWYx9V6K0fpG4gnmHeID4+C8swJkU8Qs:IkcciG39aFIW0Y4yWYh41HfD46kU8WG1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\dxgxe3.ocx
- Size 665KB
- SHA256 8a9de694a4d8a6d777933a79a14a15489d802e8c75597e78cff5f0e87ae31412
- MD5 c9f8cc14d89d58d8bc52b6c3f69177d7
- SHA1 8b39915690865f7c6e63dbcf3e49193c639c0628
- SHA512 ff0a6a72be5bca2ed6f8c60ec74cdc92f499c0e8b4059c82263c24bc7989bc7d9b8990b6c65efb9a8ac1a31cff99065b6c3a6ac7bef2633878daf1c41c1b9a50
- SSDEEP 12288:IkcciVL7KJ39aFUl29UrVNVWgdblGaIsyWYx9V6M0fpG4gnmHeID4+C8swJkU8Qs:IkcciG39aFIW0Y4yWYhO1HfD46kU8WG1
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\dxgxe2.ocx
- Size 665KB
- SHA256 40c46278d656be674b0fd733c3fbabb4edded7a2446f8ced62f7c7da1aeafb11
- MD5 efcd33bf4b68c4a102b69c9a4b1e9a35
- SHA1 06f46a7576af7c60aa87accf00904043aff990d6
- SHA512 6a8fcf240fe048d953e9c83d471e6b97b7e83a0bd5d86c9a3f9a0fd9da798bba4afa3a508e39b6bef795472cc6d12bd312a4626693fe671530af3d1d3c74bfaa
- SSDEEP 12288:IkcciVL7KJ39aFUl29UrVNVWgdblGaIsyWYx9V6K0fpG4gnmHeID4+C8swJkU8Qs:IkcciG39aFIW0Y4yWYh41HfD46kU8WG1
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\dxgxe2.ocx
- Size 665KB
- SHA256 40c46278d656be674b0fd733c3fbabb4edded7a2446f8ced62f7c7da1aeafb11
- MD5 efcd33bf4b68c4a102b69c9a4b1e9a35
- SHA1 06f46a7576af7c60aa87accf00904043aff990d6
- SHA512 6a8fcf240fe048d953e9c83d471e6b97b7e83a0bd5d86c9a3f9a0fd9da798bba4afa3a508e39b6bef795472cc6d12bd312a4626693fe671530af3d1d3c74bfaa
- SSDEEP 12288:IkcciVL7KJ39aFUl29UrVNVWgdblGaIsyWYx9V6K0fpG4gnmHeID4+C8swJkU8Qs:IkcciG39aFIW0Y4yWYh41HfD46kU8WG1
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\dxgxe3.ocx
- Size 665KB
- SHA256 8a9de694a4d8a6d777933a79a14a15489d802e8c75597e78cff5f0e87ae31412
- MD5 c9f8cc14d89d58d8bc52b6c3f69177d7
- SHA1 8b39915690865f7c6e63dbcf3e49193c639c0628
- SHA512 ff0a6a72be5bca2ed6f8c60ec74cdc92f499c0e8b4059c82263c24bc7989bc7d9b8990b6c65efb9a8ac1a31cff99065b6c3a6ac7bef2633878daf1c41c1b9a50
- SSDEEP 12288:IkcciVL7KJ39aFUl29UrVNVWgdblGaIsyWYx9V6M0fpG4gnmHeID4+C8swJkU8Qs:IkcciG39aFIW0Y4yWYhO1HfD46kU8WG1
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\dxgxe3.ocx
- Size 665KB
- SHA256 8a9de694a4d8a6d777933a79a14a15489d802e8c75597e78cff5f0e87ae31412
- MD5 c9f8cc14d89d58d8bc52b6c3f69177d7
- SHA1 8b39915690865f7c6e63dbcf3e49193c639c0628
- SHA512 ff0a6a72be5bca2ed6f8c60ec74cdc92f499c0e8b4059c82263c24bc7989bc7d9b8990b6c65efb9a8ac1a31cff99065b6c3a6ac7bef2633878daf1c41c1b9a50
- SSDEEP 12288:IkcciVL7KJ39aFUl29UrVNVWgdblGaIsyWYx9V6M0fpG4gnmHeID4+C8swJkU8Qs:IkcciG39aFIW0Y4yWYhO1HfD46kU8WG1
- MD5 SHA1 SHA512 SSDEEP