Analysis
-
max time kernel
148s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
06-07-2022 13:16
Static task
static1
Behavioral task
behavioral1
Sample
Order details.xlsx
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Order details.xlsx
Resource
win10v2004-20220414-en
General
-
Target
Order details.xlsx
-
Size
176KB
-
MD5
36e3875fa058105bc9eedb62543d3816
-
SHA1
ee1efdb171829d12f3f2eb43a4e3321121b58397
-
SHA256
54addec2aa97b3938c4ff81ee36cb37d4d3597b3c7b81f3e8106ba35e1bcbd0b
-
SHA512
18678a33e3b3320f2e0b57484871a06cfc3a2ce2e6e4a9ab6c01c1c57664eb2e42c224cfc1f7ad78fde503699edf879156fecc1fdf63895e61e4387706ac0d53
Malware Config
Extracted
formbook
4.1
s3s3
tvielotus.com
teesta.xyz
talentrecruitor.com
pamaungipb.com
xn--90ahkh6a6b8b.site
910carolina.com
toyotaecoyouth-dev.com
invetnables.com
gdexc.com
ssw168.com
householdmould.com
mqttradar.xyz
t333c.com
thepausestudio.com
evershedsutherlands.com
asbdataplus.com
preddylilthingz.com
jepwu.com
tvlido.com
artovus.com
trainingmagazineme.com
rettar.net
underneathstardoll.com
babipiko21.site
getvpsdime.com
accentsfurniture.com
cutdowns.tech
teklcin.online
sunshareesg.com
eventrewards.site
lacomunaperu.com
a-tavola.online
gshund.com
monsterflixer.com
896851.com
carpetlandcolortileflint.com
filmproduction.management
cherie-clinique.com
medjoker.com
grant-helpers.site
sussdmortgages.com
solaranlagen-forum.com
freecustomsites.com
h7578.com
ideadly.com
backend360.com
podgorskidesign.com
zilinsky.taxi
ourelevatetribe.com
thefitnesswardllc.com
eficazindustrial.com
thecovefishcamp.com
niuxy.com
myluxurypals.com
clinicadentalvelinta.com
dis99.com
crosswealth.xyz
itopjob.com
oandbcleaningservices.com
afri-solutions.com
paradiseoe.com
versionespublicas.com
b2lonline.com
usdcmeta.xyz
bense003.xyz
Signatures
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
Formbook Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1716-75-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1716-76-0x000000000041F110-mapping.dmp formbook behavioral1/memory/1716-79-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1716-88-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1756-90-0x0000000000120000-0x000000000014F000-memory.dmp formbook behavioral1/memory/1756-95-0x0000000000120000-0x000000000014F000-memory.dmp formbook -
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 3 1152 EQNEDT32.EXE -
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
vbc.exevbc.exevbc.exepid process 2032 vbc.exe 1508 vbc.exe 1716 vbc.exe -
Loads dropped DLL 4 IoCs
Processes:
EQNEDT32.EXEpid process 1152 EQNEDT32.EXE 1152 EQNEDT32.EXE 1152 EQNEDT32.EXE 1152 EQNEDT32.EXE -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 4 IoCs
Processes:
vbc.exevbc.exesvchost.exedescription pid process target process PID 2032 set thread context of 1716 2032 vbc.exe vbc.exe PID 1716 set thread context of 1276 1716 vbc.exe Explorer.EXE PID 1716 set thread context of 1276 1716 vbc.exe Explorer.EXE PID 1756 set thread context of 1276 1756 svchost.exe Explorer.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
EXCEL.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE -
Modifies registry class 64 IoCs
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597} EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print" EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1092 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
vbc.exevbc.exesvchost.exepid process 2032 vbc.exe 2032 vbc.exe 2032 vbc.exe 2032 vbc.exe 2032 vbc.exe 2032 vbc.exe 1716 vbc.exe 1716 vbc.exe 1716 vbc.exe 1756 svchost.exe 1756 svchost.exe 1756 svchost.exe 1756 svchost.exe 1756 svchost.exe 1756 svchost.exe 1756 svchost.exe 1756 svchost.exe 1756 svchost.exe 1756 svchost.exe 1756 svchost.exe 1756 svchost.exe 1756 svchost.exe 1756 svchost.exe 1756 svchost.exe 1756 svchost.exe 1756 svchost.exe 1756 svchost.exe 1756 svchost.exe 1756 svchost.exe 1756 svchost.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
vbc.exesvchost.exepid process 1716 vbc.exe 1716 vbc.exe 1716 vbc.exe 1716 vbc.exe 1756 svchost.exe 1756 svchost.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
vbc.exevbc.exeExplorer.EXEsvchost.exedescription pid process Token: SeDebugPrivilege 2032 vbc.exe Token: SeDebugPrivilege 1716 vbc.exe Token: SeShutdownPrivilege 1276 Explorer.EXE Token: SeDebugPrivilege 1756 svchost.exe Token: SeShutdownPrivilege 1276 Explorer.EXE Token: SeShutdownPrivilege 1276 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1276 Explorer.EXE 1276 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1276 Explorer.EXE 1276 Explorer.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1092 EXCEL.EXE 1092 EXCEL.EXE 1092 EXCEL.EXE -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
EQNEDT32.EXEvbc.exeExplorer.EXEsvchost.exedescription pid process target process PID 1152 wrote to memory of 2032 1152 EQNEDT32.EXE vbc.exe PID 1152 wrote to memory of 2032 1152 EQNEDT32.EXE vbc.exe PID 1152 wrote to memory of 2032 1152 EQNEDT32.EXE vbc.exe PID 1152 wrote to memory of 2032 1152 EQNEDT32.EXE vbc.exe PID 2032 wrote to memory of 1508 2032 vbc.exe vbc.exe PID 2032 wrote to memory of 1508 2032 vbc.exe vbc.exe PID 2032 wrote to memory of 1508 2032 vbc.exe vbc.exe PID 2032 wrote to memory of 1508 2032 vbc.exe vbc.exe PID 2032 wrote to memory of 1716 2032 vbc.exe vbc.exe PID 2032 wrote to memory of 1716 2032 vbc.exe vbc.exe PID 2032 wrote to memory of 1716 2032 vbc.exe vbc.exe PID 2032 wrote to memory of 1716 2032 vbc.exe vbc.exe PID 2032 wrote to memory of 1716 2032 vbc.exe vbc.exe PID 2032 wrote to memory of 1716 2032 vbc.exe vbc.exe PID 2032 wrote to memory of 1716 2032 vbc.exe vbc.exe PID 1276 wrote to memory of 1756 1276 Explorer.EXE svchost.exe PID 1276 wrote to memory of 1756 1276 Explorer.EXE svchost.exe PID 1276 wrote to memory of 1756 1276 Explorer.EXE svchost.exe PID 1276 wrote to memory of 1756 1276 Explorer.EXE svchost.exe PID 1756 wrote to memory of 364 1756 svchost.exe cmd.exe PID 1756 wrote to memory of 364 1756 svchost.exe cmd.exe PID 1756 wrote to memory of 364 1756 svchost.exe cmd.exe PID 1756 wrote to memory of 364 1756 svchost.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\Order details.xlsx"2⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Public\vbc.exe"3⤵
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\vbc.exeC:\Users\Public\vbc.exe3⤵
- Executes dropped EXE
-
C:\Users\Public\vbc.exeC:\Users\Public\vbc.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\vbc.exeFilesize
75KB
MD54504b6bca11f1bb8cd7ee7f9695ae149
SHA1b4db331aff8b3f0af7bb85c62eee8cbf94a01242
SHA256bf694c0a4856be7c6e88f8d018a2d3223b740f060e9c0f8da51df710c895860a
SHA512f8edc6b9a704d7c2921c151e0057c0054cfdfbeee5f2a70553016dea89c2918825131d54d930d6594832484f7b8b5fc80416745de2a357b69f3abc2f4fcf5504
-
C:\Users\Public\vbc.exeFilesize
75KB
MD54504b6bca11f1bb8cd7ee7f9695ae149
SHA1b4db331aff8b3f0af7bb85c62eee8cbf94a01242
SHA256bf694c0a4856be7c6e88f8d018a2d3223b740f060e9c0f8da51df710c895860a
SHA512f8edc6b9a704d7c2921c151e0057c0054cfdfbeee5f2a70553016dea89c2918825131d54d930d6594832484f7b8b5fc80416745de2a357b69f3abc2f4fcf5504
-
C:\Users\Public\vbc.exeFilesize
75KB
MD54504b6bca11f1bb8cd7ee7f9695ae149
SHA1b4db331aff8b3f0af7bb85c62eee8cbf94a01242
SHA256bf694c0a4856be7c6e88f8d018a2d3223b740f060e9c0f8da51df710c895860a
SHA512f8edc6b9a704d7c2921c151e0057c0054cfdfbeee5f2a70553016dea89c2918825131d54d930d6594832484f7b8b5fc80416745de2a357b69f3abc2f4fcf5504
-
C:\Users\Public\vbc.exeFilesize
75KB
MD54504b6bca11f1bb8cd7ee7f9695ae149
SHA1b4db331aff8b3f0af7bb85c62eee8cbf94a01242
SHA256bf694c0a4856be7c6e88f8d018a2d3223b740f060e9c0f8da51df710c895860a
SHA512f8edc6b9a704d7c2921c151e0057c0054cfdfbeee5f2a70553016dea89c2918825131d54d930d6594832484f7b8b5fc80416745de2a357b69f3abc2f4fcf5504
-
\Users\Public\vbc.exeFilesize
75KB
MD54504b6bca11f1bb8cd7ee7f9695ae149
SHA1b4db331aff8b3f0af7bb85c62eee8cbf94a01242
SHA256bf694c0a4856be7c6e88f8d018a2d3223b740f060e9c0f8da51df710c895860a
SHA512f8edc6b9a704d7c2921c151e0057c0054cfdfbeee5f2a70553016dea89c2918825131d54d930d6594832484f7b8b5fc80416745de2a357b69f3abc2f4fcf5504
-
\Users\Public\vbc.exeFilesize
75KB
MD54504b6bca11f1bb8cd7ee7f9695ae149
SHA1b4db331aff8b3f0af7bb85c62eee8cbf94a01242
SHA256bf694c0a4856be7c6e88f8d018a2d3223b740f060e9c0f8da51df710c895860a
SHA512f8edc6b9a704d7c2921c151e0057c0054cfdfbeee5f2a70553016dea89c2918825131d54d930d6594832484f7b8b5fc80416745de2a357b69f3abc2f4fcf5504
-
\Users\Public\vbc.exeFilesize
75KB
MD54504b6bca11f1bb8cd7ee7f9695ae149
SHA1b4db331aff8b3f0af7bb85c62eee8cbf94a01242
SHA256bf694c0a4856be7c6e88f8d018a2d3223b740f060e9c0f8da51df710c895860a
SHA512f8edc6b9a704d7c2921c151e0057c0054cfdfbeee5f2a70553016dea89c2918825131d54d930d6594832484f7b8b5fc80416745de2a357b69f3abc2f4fcf5504
-
\Users\Public\vbc.exeFilesize
75KB
MD54504b6bca11f1bb8cd7ee7f9695ae149
SHA1b4db331aff8b3f0af7bb85c62eee8cbf94a01242
SHA256bf694c0a4856be7c6e88f8d018a2d3223b740f060e9c0f8da51df710c895860a
SHA512f8edc6b9a704d7c2921c151e0057c0054cfdfbeee5f2a70553016dea89c2918825131d54d930d6594832484f7b8b5fc80416745de2a357b69f3abc2f4fcf5504
-
memory/364-91-0x0000000000000000-mapping.dmp
-
memory/1092-97-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1092-54-0x000000002FD51000-0x000000002FD54000-memory.dmpFilesize
12KB
-
memory/1092-56-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1092-83-0x000000007272D000-0x0000000072738000-memory.dmpFilesize
44KB
-
memory/1092-58-0x0000000075F61000-0x0000000075F63000-memory.dmpFilesize
8KB
-
memory/1092-98-0x000000007272D000-0x0000000072738000-memory.dmpFilesize
44KB
-
memory/1092-55-0x0000000071741000-0x0000000071743000-memory.dmpFilesize
8KB
-
memory/1092-57-0x000000007272D000-0x0000000072738000-memory.dmpFilesize
44KB
-
memory/1276-94-0x0000000006CF0000-0x0000000006E4E000-memory.dmpFilesize
1.4MB
-
memory/1276-86-0x0000000006610000-0x00000000066E5000-memory.dmpFilesize
852KB
-
memory/1276-82-0x00000000049A0000-0x0000000004A74000-memory.dmpFilesize
848KB
-
memory/1276-96-0x0000000006CF0000-0x0000000006E4E000-memory.dmpFilesize
1.4MB
-
memory/1716-72-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1716-73-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1716-76-0x000000000041F110-mapping.dmp
-
memory/1716-81-0x0000000000110000-0x0000000000124000-memory.dmpFilesize
80KB
-
memory/1716-80-0x0000000000770000-0x0000000000A73000-memory.dmpFilesize
3.0MB
-
memory/1716-85-0x0000000000580000-0x0000000000594000-memory.dmpFilesize
80KB
-
memory/1716-75-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1716-88-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1716-79-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1756-90-0x0000000000120000-0x000000000014F000-memory.dmpFilesize
188KB
-
memory/1756-89-0x0000000000270000-0x0000000000278000-memory.dmpFilesize
32KB
-
memory/1756-87-0x0000000000000000-mapping.dmp
-
memory/1756-92-0x0000000000880000-0x0000000000B83000-memory.dmpFilesize
3.0MB
-
memory/1756-93-0x00000000004E0000-0x0000000000573000-memory.dmpFilesize
588KB
-
memory/1756-95-0x0000000000120000-0x000000000014F000-memory.dmpFilesize
188KB
-
memory/2032-70-0x0000000000B40000-0x0000000000B8C000-memory.dmpFilesize
304KB
-
memory/2032-69-0x0000000004E70000-0x0000000004F16000-memory.dmpFilesize
664KB
-
memory/2032-67-0x0000000001150000-0x0000000001168000-memory.dmpFilesize
96KB
-
memory/2032-64-0x0000000000000000-mapping.dmp