Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
05-07-2022 03:22
Static task
static1
Behavioral task
behavioral1
Sample
MV TRUONG MINH SEA.xlsx
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
MV TRUONG MINH SEA.xlsx
Resource
win10v2004-20220414-en
General
-
Target
MV TRUONG MINH SEA.xlsx
-
Size
176KB
-
MD5
bfc885ac8275d3a48401b4fade16bb93
-
SHA1
0aab3160b4ea537f39253eaa67fe5491a99d72fd
-
SHA256
af90961d9204c394bf5e3063e42ef2541160aaff6029c0bbd68499400c79a7ed
-
SHA512
6e6624823b3d4f6988840df7491f468333044f7410ab2684c47a4db4cfa5dbfb3a9e28e41813abbf37f762cb5a32dbed0b2e7b8fe1b7c9baba6b413a64737170
Malware Config
Extracted
xloader
2.9
iewb
n8FLlgIlb1rSEg5hJ9xMbw4hcmR38Q==
5vIAIY+pt81OtWs+FdIEdk7Y
LHIKc+oWGIQUUlfAAtEEdk7Y
ePM/cX2jvHrS
5hvPEw22+fdvmJz3C8FIVq0=
mb9EeX2jvHrS
Dx2zIYNvfjo8VUo5
6jVPnyJekv2RAc4gLKNwEqQ=
KWatHyjdE5Gj1Ng=
t9lk70gzUAZty4qjbVjF
6eUBeFPzKBWT125BFNIEdk7Y
dZUXOIyqTJGj1Ng=
iL3TVh2Jl5QVStnzxcAhIL8=
J1prtyklUfZGR/xDD71IbkWRd2yx
s9FgCOBRW9bU0Y6jbVjF
RYCbQDzcFBhcylgu
Fl0BV/8RJm6F9QRg8LXXTLo=
0dhumHzrCCZ3wdQg7nFF1AlL6Tk=
xvL+iL6wwX+/wH9K4lbZ/A==
N0lVceIFD5Gj1Ng=
5/mnQbHhJ7IzcYjyQbXXTLo=
luHuIKrfNeUkJOfRV0dA8o3Ghkt95g==
yuh2thpBWtHl2ZV48rXXTLo=
ADcuaODkD5eytord4lbZ/A==
PIWRAgq8/zx4aipDyILc
TdUPJBksRZU=
NorCQjrrH5Gj1Ng=
WXUOku0EDZGj1Ng=
4w8mrX8lanCcoWZLU0SkkkSRd2yx
KIYkq/0QN5gPTFK37XszY0fa
s8lIykhdVZjlEA1g8LXXTLo=
AkBw4LE9RQNHkyRsMQ==
fLzVWEjyMarikyRsMQ==
6j1f2ZsFFRpcylgu
zu3YwbBReoIuUh1vdsGonTCDfw==
EGD0PEju53oDSuwu9765d/4KSkXU3Qxh
rc0aZhksRZU=
Un//ZcCsqyaNtEcnt6mLu7Lqdw==
V4Eqwh4FEHqIflW508EYzYSbOeC5
EiWpwJgAFRV5e1r60cAEdk7Y
VW8Pf9PN65HU1otP4lbZ/A==
FFdOyJcMGxpcylgu
KztLpY85vJkLFw==
yh8vtO4GRPQ2kyRsMQ==
qMfrSiqZvghLUyRy/7XXTLo=
eKTGPwmf3swEq2Y3
aoseYSTrlPsvGQ==
Z6tKw0RfgS5+1o6jbVjF
CyU0azDFBZGj1Ng=
7Cy+5co/ZZbhC8dW6eo=
LXmN0EJimQWHylwnbTS6afIlJZHj+Q==
2R2cFWiX1hlZYz2UKh4i12ikiTP55p5Bfg==
jqHcD+eAi5EYlVrJm0TN
cqO55WilyvQ9mG1P4lbZ/A==
BERqtpY6pZDbB8dW6eo=
VpzDHQBueZvY24qjbVjF
OWUELQ6s28NVxom7evrIPfCLfw==
5iO6Dg619fIVQz+Q3I+ZMdmwry4=
d6GiFh7QJaHO2Jxz8bXXTLo=
NlFh6bdVeihxxT1MH+A+TL3MaA==
0PWJHpPJ9zh3nasMO8FIVq0=
19Fom6FBSQ1QrMU=
aYWBmw6431DfHsdW6eo=
Jj7U++2X3M4Eq2Y3
mounscape.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/924-78-0x0000000000400000-0x000000000042C000-memory.dmp xloader behavioral1/memory/924-79-0x000000000041F840-mapping.dmp xloader behavioral1/memory/924-82-0x0000000000400000-0x000000000042C000-memory.dmp xloader behavioral1/memory/924-90-0x0000000000400000-0x000000000042C000-memory.dmp xloader behavioral1/memory/1884-94-0x0000000000080000-0x00000000000AC000-memory.dmp xloader behavioral1/memory/1884-100-0x0000000000080000-0x00000000000AC000-memory.dmp xloader -
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 3 1784 EQNEDT32.EXE -
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
vbc.exevbc.exevbc.exepid process 1680 vbc.exe 1556 vbc.exe 924 vbc.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
vbc.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\Geo\Nation vbc.exe -
Loads dropped DLL 4 IoCs
Processes:
EQNEDT32.EXEpid process 1784 EQNEDT32.EXE 1784 EQNEDT32.EXE 1784 EQNEDT32.EXE 1784 EQNEDT32.EXE -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 4 IoCs
Processes:
vbc.exevbc.exemstsc.exedescription pid process target process PID 1680 set thread context of 924 1680 vbc.exe vbc.exe PID 924 set thread context of 1268 924 vbc.exe Explorer.EXE PID 924 set thread context of 1268 924 vbc.exe Explorer.EXE PID 1884 set thread context of 1268 1884 mstsc.exe Explorer.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE -
Modifies registry class 64 IoCs
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597} EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print" EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1460 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
vbc.exevbc.exemstsc.exepid process 1680 vbc.exe 1680 vbc.exe 924 vbc.exe 924 vbc.exe 924 vbc.exe 1884 mstsc.exe 1884 mstsc.exe 1884 mstsc.exe 1884 mstsc.exe 1884 mstsc.exe 1884 mstsc.exe 1884 mstsc.exe 1884 mstsc.exe 1884 mstsc.exe 1884 mstsc.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
vbc.exemstsc.exepid process 924 vbc.exe 924 vbc.exe 924 vbc.exe 924 vbc.exe 1884 mstsc.exe 1884 mstsc.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
vbc.exevbc.exemstsc.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1680 vbc.exe Token: SeDebugPrivilege 924 vbc.exe Token: SeDebugPrivilege 1884 mstsc.exe Token: SeShutdownPrivilege 1268 Explorer.EXE Token: SeShutdownPrivilege 1268 Explorer.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1460 EXCEL.EXE 1460 EXCEL.EXE 1460 EXCEL.EXE -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
EQNEDT32.EXEvbc.exeExplorer.EXEmstsc.exedescription pid process target process PID 1784 wrote to memory of 1680 1784 EQNEDT32.EXE vbc.exe PID 1784 wrote to memory of 1680 1784 EQNEDT32.EXE vbc.exe PID 1784 wrote to memory of 1680 1784 EQNEDT32.EXE vbc.exe PID 1784 wrote to memory of 1680 1784 EQNEDT32.EXE vbc.exe PID 1680 wrote to memory of 1556 1680 vbc.exe vbc.exe PID 1680 wrote to memory of 1556 1680 vbc.exe vbc.exe PID 1680 wrote to memory of 1556 1680 vbc.exe vbc.exe PID 1680 wrote to memory of 1556 1680 vbc.exe vbc.exe PID 1680 wrote to memory of 924 1680 vbc.exe vbc.exe PID 1680 wrote to memory of 924 1680 vbc.exe vbc.exe PID 1680 wrote to memory of 924 1680 vbc.exe vbc.exe PID 1680 wrote to memory of 924 1680 vbc.exe vbc.exe PID 1680 wrote to memory of 924 1680 vbc.exe vbc.exe PID 1680 wrote to memory of 924 1680 vbc.exe vbc.exe PID 1680 wrote to memory of 924 1680 vbc.exe vbc.exe PID 1268 wrote to memory of 1884 1268 Explorer.EXE mstsc.exe PID 1268 wrote to memory of 1884 1268 Explorer.EXE mstsc.exe PID 1268 wrote to memory of 1884 1268 Explorer.EXE mstsc.exe PID 1268 wrote to memory of 1884 1268 Explorer.EXE mstsc.exe PID 1884 wrote to memory of 960 1884 mstsc.exe cmd.exe PID 1884 wrote to memory of 960 1884 mstsc.exe cmd.exe PID 1884 wrote to memory of 960 1884 mstsc.exe cmd.exe PID 1884 wrote to memory of 960 1884 mstsc.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\MV TRUONG MINH SEA.xlsx"2⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Public\vbc.exe"3⤵
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"3⤵
- Executes dropped EXE
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\vbc.exeFilesize
612KB
MD50229fa24ef686c20e6d50c5a75aa8c27
SHA107c4fa01089a3275f88ce4d7fa404040ac638c35
SHA2569696d3ec13f85ada39b140ae0096e765db0ff630f351ffa1e96484f6a4f2f030
SHA512bae11a5fa3b52c577f815dbda2aefca1a16475fd694cd62684dd31b6890731f14f1d1a3d147f5a159907b4e7e7dcc2cf5dff80b96a5e2076aa4c5cf7c2b56ca3
-
C:\Users\Public\vbc.exeFilesize
612KB
MD50229fa24ef686c20e6d50c5a75aa8c27
SHA107c4fa01089a3275f88ce4d7fa404040ac638c35
SHA2569696d3ec13f85ada39b140ae0096e765db0ff630f351ffa1e96484f6a4f2f030
SHA512bae11a5fa3b52c577f815dbda2aefca1a16475fd694cd62684dd31b6890731f14f1d1a3d147f5a159907b4e7e7dcc2cf5dff80b96a5e2076aa4c5cf7c2b56ca3
-
C:\Users\Public\vbc.exeFilesize
612KB
MD50229fa24ef686c20e6d50c5a75aa8c27
SHA107c4fa01089a3275f88ce4d7fa404040ac638c35
SHA2569696d3ec13f85ada39b140ae0096e765db0ff630f351ffa1e96484f6a4f2f030
SHA512bae11a5fa3b52c577f815dbda2aefca1a16475fd694cd62684dd31b6890731f14f1d1a3d147f5a159907b4e7e7dcc2cf5dff80b96a5e2076aa4c5cf7c2b56ca3
-
C:\Users\Public\vbc.exeFilesize
612KB
MD50229fa24ef686c20e6d50c5a75aa8c27
SHA107c4fa01089a3275f88ce4d7fa404040ac638c35
SHA2569696d3ec13f85ada39b140ae0096e765db0ff630f351ffa1e96484f6a4f2f030
SHA512bae11a5fa3b52c577f815dbda2aefca1a16475fd694cd62684dd31b6890731f14f1d1a3d147f5a159907b4e7e7dcc2cf5dff80b96a5e2076aa4c5cf7c2b56ca3
-
\Users\Public\vbc.exeFilesize
612KB
MD50229fa24ef686c20e6d50c5a75aa8c27
SHA107c4fa01089a3275f88ce4d7fa404040ac638c35
SHA2569696d3ec13f85ada39b140ae0096e765db0ff630f351ffa1e96484f6a4f2f030
SHA512bae11a5fa3b52c577f815dbda2aefca1a16475fd694cd62684dd31b6890731f14f1d1a3d147f5a159907b4e7e7dcc2cf5dff80b96a5e2076aa4c5cf7c2b56ca3
-
\Users\Public\vbc.exeFilesize
612KB
MD50229fa24ef686c20e6d50c5a75aa8c27
SHA107c4fa01089a3275f88ce4d7fa404040ac638c35
SHA2569696d3ec13f85ada39b140ae0096e765db0ff630f351ffa1e96484f6a4f2f030
SHA512bae11a5fa3b52c577f815dbda2aefca1a16475fd694cd62684dd31b6890731f14f1d1a3d147f5a159907b4e7e7dcc2cf5dff80b96a5e2076aa4c5cf7c2b56ca3
-
\Users\Public\vbc.exeFilesize
612KB
MD50229fa24ef686c20e6d50c5a75aa8c27
SHA107c4fa01089a3275f88ce4d7fa404040ac638c35
SHA2569696d3ec13f85ada39b140ae0096e765db0ff630f351ffa1e96484f6a4f2f030
SHA512bae11a5fa3b52c577f815dbda2aefca1a16475fd694cd62684dd31b6890731f14f1d1a3d147f5a159907b4e7e7dcc2cf5dff80b96a5e2076aa4c5cf7c2b56ca3
-
\Users\Public\vbc.exeFilesize
612KB
MD50229fa24ef686c20e6d50c5a75aa8c27
SHA107c4fa01089a3275f88ce4d7fa404040ac638c35
SHA2569696d3ec13f85ada39b140ae0096e765db0ff630f351ffa1e96484f6a4f2f030
SHA512bae11a5fa3b52c577f815dbda2aefca1a16475fd694cd62684dd31b6890731f14f1d1a3d147f5a159907b4e7e7dcc2cf5dff80b96a5e2076aa4c5cf7c2b56ca3
-
memory/924-78-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/924-82-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/924-87-0x00000000001D0000-0x00000000001E1000-memory.dmpFilesize
68KB
-
memory/924-84-0x0000000000140000-0x0000000000151000-memory.dmpFilesize
68KB
-
memory/924-83-0x0000000000970000-0x0000000000C73000-memory.dmpFilesize
3.0MB
-
memory/924-79-0x000000000041F840-mapping.dmp
-
memory/924-90-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/924-76-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/924-75-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/960-92-0x0000000000000000-mapping.dmp
-
memory/1268-99-0x0000000006F60000-0x00000000070A3000-memory.dmpFilesize
1.3MB
-
memory/1268-88-0x0000000006360000-0x00000000064E3000-memory.dmpFilesize
1.5MB
-
memory/1268-85-0x00000000068D0000-0x0000000006A45000-memory.dmpFilesize
1.5MB
-
memory/1268-101-0x0000000006F60000-0x00000000070A3000-memory.dmpFilesize
1.3MB
-
memory/1460-55-0x0000000071B21000-0x0000000071B23000-memory.dmpFilesize
8KB
-
memory/1460-70-0x0000000072B0D000-0x0000000072B18000-memory.dmpFilesize
44KB
-
memory/1460-58-0x00000000769D1000-0x00000000769D3000-memory.dmpFilesize
8KB
-
memory/1460-98-0x0000000072B0D000-0x0000000072B18000-memory.dmpFilesize
44KB
-
memory/1460-57-0x0000000072B0D000-0x0000000072B18000-memory.dmpFilesize
44KB
-
memory/1460-97-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1460-54-0x000000002F0F1000-0x000000002F0F4000-memory.dmpFilesize
12KB
-
memory/1460-56-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1680-64-0x0000000000000000-mapping.dmp
-
memory/1680-73-0x00000000022F0000-0x0000000002322000-memory.dmpFilesize
200KB
-
memory/1680-72-0x0000000005C90000-0x0000000005D06000-memory.dmpFilesize
472KB
-
memory/1680-71-0x0000000000520000-0x000000000052E000-memory.dmpFilesize
56KB
-
memory/1680-69-0x00000000004B0000-0x00000000004D0000-memory.dmpFilesize
128KB
-
memory/1680-67-0x0000000000DB0000-0x0000000000E4E000-memory.dmpFilesize
632KB
-
memory/1884-89-0x0000000000000000-mapping.dmp
-
memory/1884-93-0x0000000000510000-0x0000000000614000-memory.dmpFilesize
1.0MB
-
memory/1884-94-0x0000000000080000-0x00000000000AC000-memory.dmpFilesize
176KB
-
memory/1884-95-0x0000000002140000-0x0000000002443000-memory.dmpFilesize
3.0MB
-
memory/1884-96-0x0000000001FB0000-0x0000000002040000-memory.dmpFilesize
576KB
-
memory/1884-100-0x0000000000080000-0x00000000000AC000-memory.dmpFilesize
176KB