Analysis
-
max time kernel
148s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21/06/2022, 09:29
Static task
static1
Behavioral task
behavioral1
Sample
TST - Statement of Accounts(S).xlsx
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
TST - Statement of Accounts(S).xlsx
Resource
win10v2004-20220414-en
General
-
Target
TST - Statement of Accounts(S).xlsx
-
Size
71KB
-
MD5
e8ba0382721cd0b5e3f9b8674f1b80a4
-
SHA1
e5466836650b44250ca3097d67cb9269b34034f0
-
SHA256
e98f622a7d9eed1611ec02e09445aff30113b5b3d3c702d90354efd60cc6fcd4
-
SHA512
afe0696b6e5d1bba24c5f3722112225c90ebd82f31409e8f74797efe7d8bf17f2af49dd7d0edcd604cb21c72dd4a5a87fee88fe427000de71b9ac1764e0965dc
Malware Config
Extracted
xloader
2.9
rb1k
Hy3kKk3exSb8BwggZ6MfKxQ=
NCL+/Dy1jhSUG9mRm0U=
wWOomCbzt4pHcH22F16ZDMRcKw==
WTIg8VQo+NeSJsTaLk6M9XQi
GxTnP34PxKGMqI0aDg==
BCLmUMWYgpQ0hmDGRvcILQM=
ILk0ukAA71UFWNrW
aHq3rPmIgJpVF+C9GQ==
8jYg+GYnGycf+ufa9Fo=
gQpOLax1ZUbL5at4u1SkP/XMaS0=
s1abd4QIyia5Ta6zEUSM9XQi
JDL1dr1IE+a1q4zB
24b2gBbkpvG81Nh1rLjxJw==
U5KEePzSsY5a/WYuVdUXnycmbPcnk6RB
D+TYrgrRwtaL5YIUEQ==
T1gpjLMr70QZODL8/UOM9XQi
f3Efb+StKpP+MQ==
fUfDKVLlzfcCFgo=
23rI2NitbuCL
ypQDXuCwKpP+MQ==
HAb9/o1eLLQ9wSTfYYSH
dGQztBqhddBmAXhBXcxKFgs=
pot/UnwB2u3ASrJxrLjxJw==
u0T+cxPYr0QFWNrW
Xd4g6AvWeAiHFNmRm0U=
fqY0SI2eZ8o=
8drNzC++V3AVf2DUYR5ZxjZMexa6qwY=
nbJ3+p1pTrKCkI2W2WKmP/XMaS0=
2hALD5uTJQmW5YIUEQ==
xkOFeq85DZta4TTHqkaTsKRHWhWYuw==
oM7LtPFwVWgDawjY9lo=
I6fZxC063kHYasfIFUSM9XQi
3tSd2b+SQYRPWh4=
iQKA+Xs4IpIluCPfYYSH
WZeQeI4b9FYFWNrW
j4Etp+CtbuCL
wWGZaYoV9XsDjMeSwzZ1tqK0WhWYuw==
EmloL1XbangEJg==
yU6IU27/+OCqK5mc+D5pZzEXvksf
WZKSas6qakwYQB4bZaMfKxQ=
bPxAU5ReCj/E6Bmu2VI=
IOZn4Wky9gf+nyfw+Fo=
il/DFi65d1XWM96z2FA=
RtQFCV/SvsqI5YIUEQ==
n3sLWHwMx6QhefHiBg==
s1fVFTG+gQnLhOzE8nq9EMFmMg==
x6iSiQrLangEJg==
czynGrjNeuqB
96wda7Yz/9qL5YIUEQ==
cMAlpBKfasZ0knE2aKMfKxQ=
+b49sNMNangEJg==
ynKneOyojnL+HxwufAhbGocyQO8nk6RB
hsy9q0Ig6o7J5YIUEQ==
49iq9i7AWSj7EvjE9T/yIQ0=
sYxAhPrIi2QqnRrfYYSH
DAo7NXv96UD+qCnt+0SM9XQi
69TZxSrz4MxfcllPdaMfKxQ=
wIryVHQR+gzPXPIBWoh3DHEKLW0nk6RB
L6TuDuPkKpP+MQ==
S6Vr07qsKn06Pw==
fbiiiwzOangEJg==
CcAzujb9ytZvk5qm7D/yIQ0=
tAsA5EU4mfcCFgo=
0knRgKY39EwFWNrW
strictlynightowl.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
Xloader Payload 5 IoCs
resource yara_rule behavioral1/memory/1548-77-0x0000000000400000-0x000000000042C000-memory.dmp xloader behavioral1/memory/1548-78-0x000000000041F6C0-mapping.dmp xloader behavioral1/memory/1548-81-0x0000000000400000-0x000000000042C000-memory.dmp xloader behavioral1/memory/1680-88-0x00000000000C0000-0x00000000000EC000-memory.dmp xloader behavioral1/memory/1680-93-0x00000000000C0000-0x00000000000EC000-memory.dmp xloader -
Blocklisted process makes network request 1 IoCs
flow pid Process 3 1352 EQNEDT32.EXE -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
pid Process 1552 vbc.exe 1548 vbc.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Control Panel\International\Geo\Nation vbc.exe -
Loads dropped DLL 5 IoCs
pid Process 1352 EQNEDT32.EXE 1352 EQNEDT32.EXE 1352 EQNEDT32.EXE 1352 EQNEDT32.EXE 1352 EQNEDT32.EXE -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run colorcpl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\J6AHB6O0V8 = "C:\\Program Files (x86)\\Zqzshzlu\\Cookiesz4nhm.exe" colorcpl.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1552 set thread context of 1548 1552 vbc.exe 32 PID 1548 set thread context of 1368 1548 vbc.exe 15 PID 1680 set thread context of 1368 1680 colorcpl.exe 15 -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Zqzshzlu\Cookiesz4nhm.exe colorcpl.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
pid Process 1352 EQNEDT32.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key created \Registry\User\S-1-5-21-1819626980-2277161760-1023733287-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 colorcpl.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND EXCEL.EXE -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1092 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 1548 vbc.exe 1548 vbc.exe 1680 colorcpl.exe 1680 colorcpl.exe 1680 colorcpl.exe 1680 colorcpl.exe 1680 colorcpl.exe 1680 colorcpl.exe 1680 colorcpl.exe 1680 colorcpl.exe 1680 colorcpl.exe 1680 colorcpl.exe 1680 colorcpl.exe 1680 colorcpl.exe 1680 colorcpl.exe 1680 colorcpl.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 1548 vbc.exe 1548 vbc.exe 1548 vbc.exe 1680 colorcpl.exe 1680 colorcpl.exe 1680 colorcpl.exe 1680 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1548 vbc.exe Token: SeDebugPrivilege 1680 colorcpl.exe Token: SeShutdownPrivilege 1368 Explorer.EXE Token: SeShutdownPrivilege 1368 Explorer.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1092 EXCEL.EXE 1092 EXCEL.EXE 1092 EXCEL.EXE -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1352 wrote to memory of 1552 1352 EQNEDT32.EXE 30 PID 1352 wrote to memory of 1552 1352 EQNEDT32.EXE 30 PID 1352 wrote to memory of 1552 1352 EQNEDT32.EXE 30 PID 1352 wrote to memory of 1552 1352 EQNEDT32.EXE 30 PID 1552 wrote to memory of 1548 1552 vbc.exe 32 PID 1552 wrote to memory of 1548 1552 vbc.exe 32 PID 1552 wrote to memory of 1548 1552 vbc.exe 32 PID 1552 wrote to memory of 1548 1552 vbc.exe 32 PID 1552 wrote to memory of 1548 1552 vbc.exe 32 PID 1552 wrote to memory of 1548 1552 vbc.exe 32 PID 1552 wrote to memory of 1548 1552 vbc.exe 32 PID 1368 wrote to memory of 1680 1368 Explorer.EXE 33 PID 1368 wrote to memory of 1680 1368 Explorer.EXE 33 PID 1368 wrote to memory of 1680 1368 Explorer.EXE 33 PID 1368 wrote to memory of 1680 1368 Explorer.EXE 33 PID 1680 wrote to memory of 972 1680 colorcpl.exe 34 PID 1680 wrote to memory of 972 1680 colorcpl.exe 34 PID 1680 wrote to memory of 972 1680 colorcpl.exe 34 PID 1680 wrote to memory of 972 1680 colorcpl.exe 34 PID 1680 wrote to memory of 1468 1680 colorcpl.exe 36 PID 1680 wrote to memory of 1468 1680 colorcpl.exe 36 PID 1680 wrote to memory of 1468 1680 colorcpl.exe 36 PID 1680 wrote to memory of 1468 1680 colorcpl.exe 36 PID 1680 wrote to memory of 1468 1680 colorcpl.exe 36
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\TST - Statement of Accounts(S).xlsx"2⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1092
-
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Public\vbc.exe"3⤵PID:972
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:1468
-
-
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1548
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
451KB
MD59e1bb80ff1f6f5181ed26c62ef3de29d
SHA15c37096275b5947dfd68ccacc92eec204fa73883
SHA256a92f8917b2e98217ede5359f7906dd0a60df26e087a1e1c33b81797a334fb448
SHA512f1493090882bbe106508b50a0dcc8ac9966b157837f3d3d428b5b1977bcda3ea00eb067b5f925add5a38e069cfb4e7ce63be49ba8db29b23eb171290226e7004
-
Filesize
451KB
MD59e1bb80ff1f6f5181ed26c62ef3de29d
SHA15c37096275b5947dfd68ccacc92eec204fa73883
SHA256a92f8917b2e98217ede5359f7906dd0a60df26e087a1e1c33b81797a334fb448
SHA512f1493090882bbe106508b50a0dcc8ac9966b157837f3d3d428b5b1977bcda3ea00eb067b5f925add5a38e069cfb4e7ce63be49ba8db29b23eb171290226e7004
-
Filesize
451KB
MD59e1bb80ff1f6f5181ed26c62ef3de29d
SHA15c37096275b5947dfd68ccacc92eec204fa73883
SHA256a92f8917b2e98217ede5359f7906dd0a60df26e087a1e1c33b81797a334fb448
SHA512f1493090882bbe106508b50a0dcc8ac9966b157837f3d3d428b5b1977bcda3ea00eb067b5f925add5a38e069cfb4e7ce63be49ba8db29b23eb171290226e7004
-
Filesize
451KB
MD59e1bb80ff1f6f5181ed26c62ef3de29d
SHA15c37096275b5947dfd68ccacc92eec204fa73883
SHA256a92f8917b2e98217ede5359f7906dd0a60df26e087a1e1c33b81797a334fb448
SHA512f1493090882bbe106508b50a0dcc8ac9966b157837f3d3d428b5b1977bcda3ea00eb067b5f925add5a38e069cfb4e7ce63be49ba8db29b23eb171290226e7004
-
Filesize
451KB
MD59e1bb80ff1f6f5181ed26c62ef3de29d
SHA15c37096275b5947dfd68ccacc92eec204fa73883
SHA256a92f8917b2e98217ede5359f7906dd0a60df26e087a1e1c33b81797a334fb448
SHA512f1493090882bbe106508b50a0dcc8ac9966b157837f3d3d428b5b1977bcda3ea00eb067b5f925add5a38e069cfb4e7ce63be49ba8db29b23eb171290226e7004
-
Filesize
451KB
MD59e1bb80ff1f6f5181ed26c62ef3de29d
SHA15c37096275b5947dfd68ccacc92eec204fa73883
SHA256a92f8917b2e98217ede5359f7906dd0a60df26e087a1e1c33b81797a334fb448
SHA512f1493090882bbe106508b50a0dcc8ac9966b157837f3d3d428b5b1977bcda3ea00eb067b5f925add5a38e069cfb4e7ce63be49ba8db29b23eb171290226e7004
-
Filesize
451KB
MD59e1bb80ff1f6f5181ed26c62ef3de29d
SHA15c37096275b5947dfd68ccacc92eec204fa73883
SHA256a92f8917b2e98217ede5359f7906dd0a60df26e087a1e1c33b81797a334fb448
SHA512f1493090882bbe106508b50a0dcc8ac9966b157837f3d3d428b5b1977bcda3ea00eb067b5f925add5a38e069cfb4e7ce63be49ba8db29b23eb171290226e7004
-
Filesize
451KB
MD59e1bb80ff1f6f5181ed26c62ef3de29d
SHA15c37096275b5947dfd68ccacc92eec204fa73883
SHA256a92f8917b2e98217ede5359f7906dd0a60df26e087a1e1c33b81797a334fb448
SHA512f1493090882bbe106508b50a0dcc8ac9966b157837f3d3d428b5b1977bcda3ea00eb067b5f925add5a38e069cfb4e7ce63be49ba8db29b23eb171290226e7004