Analysis
-
max time kernel
146s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
05-07-2022 03:23
Static task
static1
Behavioral task
behavioral1
Sample
MV TRUONG MINH SEA.xlsx
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
MV TRUONG MINH SEA.xlsx
Resource
win10v2004-20220414-en
General
-
Target
MV TRUONG MINH SEA.xlsx
-
Size
176KB
-
MD5
bfc885ac8275d3a48401b4fade16bb93
-
SHA1
0aab3160b4ea537f39253eaa67fe5491a99d72fd
-
SHA256
af90961d9204c394bf5e3063e42ef2541160aaff6029c0bbd68499400c79a7ed
-
SHA512
6e6624823b3d4f6988840df7491f468333044f7410ab2684c47a4db4cfa5dbfb3a9e28e41813abbf37f762cb5a32dbed0b2e7b8fe1b7c9baba6b413a64737170
Malware Config
Extracted
xloader
2.9
iewb
n8FLlgIlb1rSEg5hJ9xMbw4hcmR38Q==
5vIAIY+pt81OtWs+FdIEdk7Y
LHIKc+oWGIQUUlfAAtEEdk7Y
ePM/cX2jvHrS
5hvPEw22+fdvmJz3C8FIVq0=
mb9EeX2jvHrS
Dx2zIYNvfjo8VUo5
6jVPnyJekv2RAc4gLKNwEqQ=
KWatHyjdE5Gj1Ng=
t9lk70gzUAZty4qjbVjF
6eUBeFPzKBWT125BFNIEdk7Y
dZUXOIyqTJGj1Ng=
iL3TVh2Jl5QVStnzxcAhIL8=
J1prtyklUfZGR/xDD71IbkWRd2yx
s9FgCOBRW9bU0Y6jbVjF
RYCbQDzcFBhcylgu
Fl0BV/8RJm6F9QRg8LXXTLo=
0dhumHzrCCZ3wdQg7nFF1AlL6Tk=
xvL+iL6wwX+/wH9K4lbZ/A==
N0lVceIFD5Gj1Ng=
5/mnQbHhJ7IzcYjyQbXXTLo=
luHuIKrfNeUkJOfRV0dA8o3Ghkt95g==
yuh2thpBWtHl2ZV48rXXTLo=
ADcuaODkD5eytord4lbZ/A==
PIWRAgq8/zx4aipDyILc
TdUPJBksRZU=
NorCQjrrH5Gj1Ng=
WXUOku0EDZGj1Ng=
4w8mrX8lanCcoWZLU0SkkkSRd2yx
KIYkq/0QN5gPTFK37XszY0fa
s8lIykhdVZjlEA1g8LXXTLo=
AkBw4LE9RQNHkyRsMQ==
fLzVWEjyMarikyRsMQ==
6j1f2ZsFFRpcylgu
zu3YwbBReoIuUh1vdsGonTCDfw==
EGD0PEju53oDSuwu9765d/4KSkXU3Qxh
rc0aZhksRZU=
Un//ZcCsqyaNtEcnt6mLu7Lqdw==
V4Eqwh4FEHqIflW508EYzYSbOeC5
EiWpwJgAFRV5e1r60cAEdk7Y
VW8Pf9PN65HU1otP4lbZ/A==
FFdOyJcMGxpcylgu
KztLpY85vJkLFw==
yh8vtO4GRPQ2kyRsMQ==
qMfrSiqZvghLUyRy/7XXTLo=
eKTGPwmf3swEq2Y3
aoseYSTrlPsvGQ==
Z6tKw0RfgS5+1o6jbVjF
CyU0azDFBZGj1Ng=
7Cy+5co/ZZbhC8dW6eo=
LXmN0EJimQWHylwnbTS6afIlJZHj+Q==
2R2cFWiX1hlZYz2UKh4i12ikiTP55p5Bfg==
jqHcD+eAi5EYlVrJm0TN
cqO55WilyvQ9mG1P4lbZ/A==
BERqtpY6pZDbB8dW6eo=
VpzDHQBueZvY24qjbVjF
OWUELQ6s28NVxom7evrIPfCLfw==
5iO6Dg619fIVQz+Q3I+ZMdmwry4=
d6GiFh7QJaHO2Jxz8bXXTLo=
NlFh6bdVeihxxT1MH+A+TL3MaA==
0PWJHpPJ9zh3nasMO8FIVq0=
19Fom6FBSQ1QrMU=
aYWBmw6431DfHsdW6eo=
Jj7U++2X3M4Eq2Y3
mounscape.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/868-77-0x0000000000400000-0x000000000042C000-memory.dmp xloader behavioral1/memory/868-78-0x000000000041F840-mapping.dmp xloader behavioral1/memory/868-81-0x0000000000400000-0x000000000042C000-memory.dmp xloader behavioral1/memory/1616-87-0x00000000000C0000-0x00000000000EC000-memory.dmp xloader behavioral1/memory/1616-94-0x00000000000C0000-0x00000000000EC000-memory.dmp xloader -
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 3 1108 EQNEDT32.EXE -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
vbc.exevbc.exepid process 1396 vbc.exe 868 vbc.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
vbc.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Control Panel\International\Geo\Nation vbc.exe -
Loads dropped DLL 5 IoCs
Processes:
EQNEDT32.EXEhelp.exepid process 1108 EQNEDT32.EXE 1108 EQNEDT32.EXE 1108 EQNEDT32.EXE 1108 EQNEDT32.EXE 1616 help.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
help.exedescription ioc process Key created \Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run help.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\0FDXY = "C:\\Program Files (x86)\\Uqdfh\\msmrrp8zlp.exe" help.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
vbc.exevbc.exehelp.exedescription pid process target process PID 1396 set thread context of 868 1396 vbc.exe vbc.exe PID 868 set thread context of 1268 868 vbc.exe Explorer.EXE PID 1616 set thread context of 1268 1616 help.exe Explorer.EXE -
Drops file in Program Files directory 1 IoCs
Processes:
help.exedescription ioc process File opened for modification C:\Program Files (x86)\Uqdfh\msmrrp8zlp.exe help.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
EXCEL.EXEhelp.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key created \Registry\User\S-1-5-21-790309383-526510583-3802439154-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 help.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE -
Modifies registry class 64 IoCs
Processes:
EXCEL.EXEdescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597} EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1604 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
vbc.exehelp.exepid process 868 vbc.exe 868 vbc.exe 1616 help.exe 1616 help.exe 1616 help.exe 1616 help.exe 1616 help.exe 1616 help.exe 1616 help.exe 1616 help.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
vbc.exehelp.exepid process 868 vbc.exe 868 vbc.exe 868 vbc.exe 1616 help.exe 1616 help.exe 1616 help.exe 1616 help.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
vbc.exehelp.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 868 vbc.exe Token: SeDebugPrivilege 1616 help.exe Token: SeShutdownPrivilege 1268 Explorer.EXE Token: SeShutdownPrivilege 1268 Explorer.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1604 EXCEL.EXE 1604 EXCEL.EXE 1604 EXCEL.EXE -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
EQNEDT32.EXEvbc.exeExplorer.EXEhelp.exedescription pid process target process PID 1108 wrote to memory of 1396 1108 EQNEDT32.EXE vbc.exe PID 1108 wrote to memory of 1396 1108 EQNEDT32.EXE vbc.exe PID 1108 wrote to memory of 1396 1108 EQNEDT32.EXE vbc.exe PID 1108 wrote to memory of 1396 1108 EQNEDT32.EXE vbc.exe PID 1396 wrote to memory of 868 1396 vbc.exe vbc.exe PID 1396 wrote to memory of 868 1396 vbc.exe vbc.exe PID 1396 wrote to memory of 868 1396 vbc.exe vbc.exe PID 1396 wrote to memory of 868 1396 vbc.exe vbc.exe PID 1396 wrote to memory of 868 1396 vbc.exe vbc.exe PID 1396 wrote to memory of 868 1396 vbc.exe vbc.exe PID 1396 wrote to memory of 868 1396 vbc.exe vbc.exe PID 1268 wrote to memory of 1616 1268 Explorer.EXE help.exe PID 1268 wrote to memory of 1616 1268 Explorer.EXE help.exe PID 1268 wrote to memory of 1616 1268 Explorer.EXE help.exe PID 1268 wrote to memory of 1616 1268 Explorer.EXE help.exe PID 1616 wrote to memory of 2036 1616 help.exe cmd.exe PID 1616 wrote to memory of 2036 1616 help.exe cmd.exe PID 1616 wrote to memory of 2036 1616 help.exe cmd.exe PID 1616 wrote to memory of 2036 1616 help.exe cmd.exe PID 1616 wrote to memory of 552 1616 help.exe Firefox.exe PID 1616 wrote to memory of 552 1616 help.exe Firefox.exe PID 1616 wrote to memory of 552 1616 help.exe Firefox.exe PID 1616 wrote to memory of 552 1616 help.exe Firefox.exe PID 1616 wrote to memory of 552 1616 help.exe Firefox.exe PID 1616 wrote to memory of 1732 1616 help.exe cmd.exe PID 1616 wrote to memory of 1732 1616 help.exe cmd.exe PID 1616 wrote to memory of 1732 1616 help.exe cmd.exe PID 1616 wrote to memory of 1732 1616 help.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\MV TRUONG MINH SEA.xlsx"2⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Public\vbc.exe"3⤵
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\DB1Filesize
40KB
MD5b608d407fc15adea97c26936bc6f03f6
SHA1953e7420801c76393902c0d6bb56148947e41571
SHA256b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf
SHA512cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4
-
C:\Users\Public\vbc.exeFilesize
612KB
MD50229fa24ef686c20e6d50c5a75aa8c27
SHA107c4fa01089a3275f88ce4d7fa404040ac638c35
SHA2569696d3ec13f85ada39b140ae0096e765db0ff630f351ffa1e96484f6a4f2f030
SHA512bae11a5fa3b52c577f815dbda2aefca1a16475fd694cd62684dd31b6890731f14f1d1a3d147f5a159907b4e7e7dcc2cf5dff80b96a5e2076aa4c5cf7c2b56ca3
-
C:\Users\Public\vbc.exeFilesize
612KB
MD50229fa24ef686c20e6d50c5a75aa8c27
SHA107c4fa01089a3275f88ce4d7fa404040ac638c35
SHA2569696d3ec13f85ada39b140ae0096e765db0ff630f351ffa1e96484f6a4f2f030
SHA512bae11a5fa3b52c577f815dbda2aefca1a16475fd694cd62684dd31b6890731f14f1d1a3d147f5a159907b4e7e7dcc2cf5dff80b96a5e2076aa4c5cf7c2b56ca3
-
C:\Users\Public\vbc.exeFilesize
612KB
MD50229fa24ef686c20e6d50c5a75aa8c27
SHA107c4fa01089a3275f88ce4d7fa404040ac638c35
SHA2569696d3ec13f85ada39b140ae0096e765db0ff630f351ffa1e96484f6a4f2f030
SHA512bae11a5fa3b52c577f815dbda2aefca1a16475fd694cd62684dd31b6890731f14f1d1a3d147f5a159907b4e7e7dcc2cf5dff80b96a5e2076aa4c5cf7c2b56ca3
-
\Users\Admin\AppData\Local\Temp\sqlite3.dllFilesize
628KB
MD5e3b107beaf9eaab93d09738d7dcb0946
SHA1e625eac28fad8d1ed8544a35b9e54e596313b266
SHA2568dccdffda1babc90e9917e7927c7387e4ca8e556f0bb94aace207c998a289223
SHA512c08038d6c7c527ae1e13540358c2a117e5aa6275643b2d88e19e1dc7dd0aa4191c74598e385c57d854866c2de31688fb3640bc7e3a2303b8291154375398305a
-
\Users\Public\vbc.exeFilesize
612KB
MD50229fa24ef686c20e6d50c5a75aa8c27
SHA107c4fa01089a3275f88ce4d7fa404040ac638c35
SHA2569696d3ec13f85ada39b140ae0096e765db0ff630f351ffa1e96484f6a4f2f030
SHA512bae11a5fa3b52c577f815dbda2aefca1a16475fd694cd62684dd31b6890731f14f1d1a3d147f5a159907b4e7e7dcc2cf5dff80b96a5e2076aa4c5cf7c2b56ca3
-
\Users\Public\vbc.exeFilesize
612KB
MD50229fa24ef686c20e6d50c5a75aa8c27
SHA107c4fa01089a3275f88ce4d7fa404040ac638c35
SHA2569696d3ec13f85ada39b140ae0096e765db0ff630f351ffa1e96484f6a4f2f030
SHA512bae11a5fa3b52c577f815dbda2aefca1a16475fd694cd62684dd31b6890731f14f1d1a3d147f5a159907b4e7e7dcc2cf5dff80b96a5e2076aa4c5cf7c2b56ca3
-
\Users\Public\vbc.exeFilesize
612KB
MD50229fa24ef686c20e6d50c5a75aa8c27
SHA107c4fa01089a3275f88ce4d7fa404040ac638c35
SHA2569696d3ec13f85ada39b140ae0096e765db0ff630f351ffa1e96484f6a4f2f030
SHA512bae11a5fa3b52c577f815dbda2aefca1a16475fd694cd62684dd31b6890731f14f1d1a3d147f5a159907b4e7e7dcc2cf5dff80b96a5e2076aa4c5cf7c2b56ca3
-
\Users\Public\vbc.exeFilesize
612KB
MD50229fa24ef686c20e6d50c5a75aa8c27
SHA107c4fa01089a3275f88ce4d7fa404040ac638c35
SHA2569696d3ec13f85ada39b140ae0096e765db0ff630f351ffa1e96484f6a4f2f030
SHA512bae11a5fa3b52c577f815dbda2aefca1a16475fd694cd62684dd31b6890731f14f1d1a3d147f5a159907b4e7e7dcc2cf5dff80b96a5e2076aa4c5cf7c2b56ca3
-
memory/868-74-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/868-83-0x00000000002A0000-0x00000000002B1000-memory.dmpFilesize
68KB
-
memory/868-82-0x0000000000990000-0x0000000000C93000-memory.dmpFilesize
3.0MB
-
memory/868-81-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/868-78-0x000000000041F840-mapping.dmp
-
memory/868-77-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/868-75-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1268-101-0x000007FF09090000-0x000007FF0909A000-memory.dmpFilesize
40KB
-
memory/1268-100-0x000007FEF6A40000-0x000007FEF6B83000-memory.dmpFilesize
1.3MB
-
memory/1268-96-0x0000000007210000-0x0000000007388000-memory.dmpFilesize
1.5MB
-
memory/1268-93-0x0000000007210000-0x0000000007388000-memory.dmpFilesize
1.5MB
-
memory/1268-84-0x0000000007060000-0x0000000007205000-memory.dmpFilesize
1.6MB
-
memory/1396-72-0x0000000005CE0000-0x0000000005D56000-memory.dmpFilesize
472KB
-
memory/1396-73-0x0000000001380000-0x00000000013B2000-memory.dmpFilesize
200KB
-
memory/1396-71-0x0000000000BE0000-0x0000000000BEE000-memory.dmpFilesize
56KB
-
memory/1396-70-0x0000000000790000-0x00000000007B0000-memory.dmpFilesize
128KB
-
memory/1396-67-0x00000000013B0000-0x000000000144E000-memory.dmpFilesize
632KB
-
memory/1396-64-0x0000000000000000-mapping.dmp
-
memory/1604-92-0x000000007257D000-0x0000000072588000-memory.dmpFilesize
44KB
-
memory/1604-58-0x0000000076241000-0x0000000076243000-memory.dmpFilesize
8KB
-
memory/1604-54-0x000000002FC11000-0x000000002FC14000-memory.dmpFilesize
12KB
-
memory/1604-69-0x000000007257D000-0x0000000072588000-memory.dmpFilesize
44KB
-
memory/1604-55-0x0000000071591000-0x0000000071593000-memory.dmpFilesize
8KB
-
memory/1604-56-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1604-91-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1604-57-0x000000007257D000-0x0000000072588000-memory.dmpFilesize
44KB
-
memory/1616-89-0x00000000008E0000-0x0000000000BE3000-memory.dmpFilesize
3.0MB
-
memory/1616-94-0x00000000000C0000-0x00000000000EC000-memory.dmpFilesize
176KB
-
memory/1616-85-0x0000000000000000-mapping.dmp
-
memory/1616-90-0x0000000000530000-0x00000000005C0000-memory.dmpFilesize
576KB
-
memory/1616-86-0x0000000000490000-0x0000000000496000-memory.dmpFilesize
24KB
-
memory/1616-87-0x00000000000C0000-0x00000000000EC000-memory.dmpFilesize
176KB
-
memory/1732-98-0x0000000000000000-mapping.dmp
-
memory/2036-88-0x0000000000000000-mapping.dmp