Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
16/06/2022, 09:51
Static task
static1
Behavioral task
behavioral1
Sample
ordine n.223737-3748.xlsx
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
ordine n.223737-3748.xlsx
Resource
win10v2004-20220414-en
General
-
Target
ordine n.223737-3748.xlsx
-
Size
255KB
-
MD5
7a1d66b7ff2e9ac7fa6b971165ff4e36
-
SHA1
94ac522422a381a85649f705337e05aa517231ee
-
SHA256
bb67823344c66355e808040a736b0cf9c4f1676429f6e643880a4f057ce0be00
-
SHA512
d93defcbf8afc7a0fd7a512c043c22c0474296cfd17895f75a9215b9ba352dcee547a512372c1cdc04a5de2c7338fae83814f65c0ef2d327343ad3cad6f258a4
Malware Config
Extracted
xloader
2.6
oecd
mrcrickethighlights.com
milozzo.com
biggorillacreative.com
pecwi67.store
stoneeast.com
redicredi.com
warrentonvalodging.com
lexbbc.com
acmet-shirtco.com
grocits.com
vlconstruction.info
jxstore1.com
lifeenrollmarketplace.com
wgr5n.xyz
710wgm.com
ccrdidkqpoxzrrpfpmcb.com
boswellbrothersofnc.net
girajewelry.com
primesukkah.com
daotengge.com
nishorgonishad.com
bakeymakey.com
eatingspotbr.com
dispectra.com
sunglassestag.net
avenidagold.com
ptkiss.com
request.onl
blogging-news.com
hbxrys.com
alomarifamily.com
dzpmzf.club
jimsan.com
polynerdle.com
bojan-milenkovic.com
gripstogo.com
cargoplase.com
ledyardhomes.com
wisconsintowingservices.com
antersen.com
jylzxyy.com
sitrak-russia.com
illicitworldwide.com
fortymall.com
depline.site
ketoyjugyshop.xyz
engematec.com
americapatriotpayments.com
dzylfjx.com
ryancapmonkey.com
arbah-capital.online
igetoa.com
course-secrets.com
sanluisalminuto.com
brekenseyphotos.com
weddingsiteshop.com
infobmwpromo.com
umeizhi.com
ashitasanwalka.com
wpew.xyz
cocoron5.com
lugmwv-udps.website
xiaoyouquanzi.com
qk-study.com
jfcls.xyz
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 6 IoCs
resource yara_rule behavioral1/memory/1488-77-0x0000000000400000-0x000000000042B000-memory.dmp xloader behavioral1/memory/1488-78-0x000000000041F1E0-mapping.dmp xloader behavioral1/memory/1488-81-0x0000000000400000-0x000000000042B000-memory.dmp xloader behavioral1/memory/1488-89-0x0000000000400000-0x000000000042B000-memory.dmp xloader behavioral1/memory/740-92-0x0000000000080000-0x00000000000AB000-memory.dmp xloader behavioral1/memory/740-99-0x0000000000080000-0x00000000000AB000-memory.dmp xloader -
Blocklisted process makes network request 1 IoCs
flow pid Process 3 1724 EQNEDT32.EXE -
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
pid Process 1680 vbc.exe 948 vbc.exe 1488 vbc.exe -
Loads dropped DLL 4 IoCs
pid Process 1724 EQNEDT32.EXE 1724 EQNEDT32.EXE 1724 EQNEDT32.EXE 1724 EQNEDT32.EXE -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1680 set thread context of 1488 1680 vbc.exe 33 PID 1488 set thread context of 1392 1488 vbc.exe 15 PID 1488 set thread context of 1392 1488 vbc.exe 15 PID 740 set thread context of 1392 740 colorcpl.exe 15 -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
pid Process 1724 EQNEDT32.EXE -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597} EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1944 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 1680 vbc.exe 1680 vbc.exe 1488 vbc.exe 1488 vbc.exe 1488 vbc.exe 740 colorcpl.exe 740 colorcpl.exe 740 colorcpl.exe 740 colorcpl.exe 740 colorcpl.exe 740 colorcpl.exe 740 colorcpl.exe 740 colorcpl.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 1488 vbc.exe 1488 vbc.exe 1488 vbc.exe 1488 vbc.exe 740 colorcpl.exe 740 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1680 vbc.exe Token: SeDebugPrivilege 1488 vbc.exe Token: SeDebugPrivilege 740 colorcpl.exe Token: SeShutdownPrivilege 1392 Explorer.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1944 EXCEL.EXE 1944 EXCEL.EXE 1944 EXCEL.EXE -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 1724 wrote to memory of 1680 1724 EQNEDT32.EXE 30 PID 1724 wrote to memory of 1680 1724 EQNEDT32.EXE 30 PID 1724 wrote to memory of 1680 1724 EQNEDT32.EXE 30 PID 1724 wrote to memory of 1680 1724 EQNEDT32.EXE 30 PID 1680 wrote to memory of 948 1680 vbc.exe 32 PID 1680 wrote to memory of 948 1680 vbc.exe 32 PID 1680 wrote to memory of 948 1680 vbc.exe 32 PID 1680 wrote to memory of 948 1680 vbc.exe 32 PID 1680 wrote to memory of 1488 1680 vbc.exe 33 PID 1680 wrote to memory of 1488 1680 vbc.exe 33 PID 1680 wrote to memory of 1488 1680 vbc.exe 33 PID 1680 wrote to memory of 1488 1680 vbc.exe 33 PID 1680 wrote to memory of 1488 1680 vbc.exe 33 PID 1680 wrote to memory of 1488 1680 vbc.exe 33 PID 1680 wrote to memory of 1488 1680 vbc.exe 33 PID 1392 wrote to memory of 740 1392 Explorer.EXE 34 PID 1392 wrote to memory of 740 1392 Explorer.EXE 34 PID 1392 wrote to memory of 740 1392 Explorer.EXE 34 PID 1392 wrote to memory of 740 1392 Explorer.EXE 34 PID 740 wrote to memory of 1060 740 colorcpl.exe 35 PID 740 wrote to memory of 1060 740 colorcpl.exe 35 PID 740 wrote to memory of 1060 740 colorcpl.exe 35 PID 740 wrote to memory of 1060 740 colorcpl.exe 35
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\ordine n.223737-3748.xlsx"2⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1944
-
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Public\vbc.exe"3⤵PID:1060
-
-
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"3⤵
- Executes dropped EXE
PID:948
-
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1488
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
632KB
MD5f413642263b39b39fc90ea1ef32bcc01
SHA16ae21aa75be549567131a4d4acf4dfb68d40ecf7
SHA256f62c3f81cd0f8db52470b8ca25ffae0c0eb20c202e90db9425e9904d3e673b8d
SHA51271893e9a24e54af2acda3aea6cdc9be27c64287fb849b55b0ac0512b9aeda88a446f7054b6ccfc75668a9ce285235d970204817e786ab6409ae41a58dcd15af3
-
Filesize
632KB
MD5f413642263b39b39fc90ea1ef32bcc01
SHA16ae21aa75be549567131a4d4acf4dfb68d40ecf7
SHA256f62c3f81cd0f8db52470b8ca25ffae0c0eb20c202e90db9425e9904d3e673b8d
SHA51271893e9a24e54af2acda3aea6cdc9be27c64287fb849b55b0ac0512b9aeda88a446f7054b6ccfc75668a9ce285235d970204817e786ab6409ae41a58dcd15af3
-
Filesize
632KB
MD5f413642263b39b39fc90ea1ef32bcc01
SHA16ae21aa75be549567131a4d4acf4dfb68d40ecf7
SHA256f62c3f81cd0f8db52470b8ca25ffae0c0eb20c202e90db9425e9904d3e673b8d
SHA51271893e9a24e54af2acda3aea6cdc9be27c64287fb849b55b0ac0512b9aeda88a446f7054b6ccfc75668a9ce285235d970204817e786ab6409ae41a58dcd15af3
-
Filesize
632KB
MD5f413642263b39b39fc90ea1ef32bcc01
SHA16ae21aa75be549567131a4d4acf4dfb68d40ecf7
SHA256f62c3f81cd0f8db52470b8ca25ffae0c0eb20c202e90db9425e9904d3e673b8d
SHA51271893e9a24e54af2acda3aea6cdc9be27c64287fb849b55b0ac0512b9aeda88a446f7054b6ccfc75668a9ce285235d970204817e786ab6409ae41a58dcd15af3
-
Filesize
632KB
MD5f413642263b39b39fc90ea1ef32bcc01
SHA16ae21aa75be549567131a4d4acf4dfb68d40ecf7
SHA256f62c3f81cd0f8db52470b8ca25ffae0c0eb20c202e90db9425e9904d3e673b8d
SHA51271893e9a24e54af2acda3aea6cdc9be27c64287fb849b55b0ac0512b9aeda88a446f7054b6ccfc75668a9ce285235d970204817e786ab6409ae41a58dcd15af3
-
Filesize
632KB
MD5f413642263b39b39fc90ea1ef32bcc01
SHA16ae21aa75be549567131a4d4acf4dfb68d40ecf7
SHA256f62c3f81cd0f8db52470b8ca25ffae0c0eb20c202e90db9425e9904d3e673b8d
SHA51271893e9a24e54af2acda3aea6cdc9be27c64287fb849b55b0ac0512b9aeda88a446f7054b6ccfc75668a9ce285235d970204817e786ab6409ae41a58dcd15af3
-
Filesize
632KB
MD5f413642263b39b39fc90ea1ef32bcc01
SHA16ae21aa75be549567131a4d4acf4dfb68d40ecf7
SHA256f62c3f81cd0f8db52470b8ca25ffae0c0eb20c202e90db9425e9904d3e673b8d
SHA51271893e9a24e54af2acda3aea6cdc9be27c64287fb849b55b0ac0512b9aeda88a446f7054b6ccfc75668a9ce285235d970204817e786ab6409ae41a58dcd15af3
-
Filesize
632KB
MD5f413642263b39b39fc90ea1ef32bcc01
SHA16ae21aa75be549567131a4d4acf4dfb68d40ecf7
SHA256f62c3f81cd0f8db52470b8ca25ffae0c0eb20c202e90db9425e9904d3e673b8d
SHA51271893e9a24e54af2acda3aea6cdc9be27c64287fb849b55b0ac0512b9aeda88a446f7054b6ccfc75668a9ce285235d970204817e786ab6409ae41a58dcd15af3