Analysis
-
max time kernel
140s -
max time network
169s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
02-08-2022 17:48
Static task
static1
Behavioral task
behavioral1
Sample
PO -002784.xlsx
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
PO -002784.xlsx
Resource
win10v2004-20220721-en
General
-
Target
PO -002784.xlsx
-
Size
110KB
-
MD5
cbcfc683f542c0cb7801ad70ce218b78
-
SHA1
dd2cade0bff6cf73167be9679ea1cce1297cbaeb
-
SHA256
8f34a51b15fbfdb665e6593b46c0489072c05dd791f3dab1b0c30b44bb39a7fb
-
SHA512
896df789768cbcf1283f10463342b59ff016ae36ecdc668a5838cc403ba086b3c965d1ccbd2c3e36e017e5b84ca8055ccf7ea5297998c9f88b9c1fb762dfa4be
Malware Config
Extracted
netwire
37.0.14.206:3384
-
activex_autorun
false
-
copy_executable
true
-
delete_original
false
-
host_id
HostId-%Rand%
-
install_path
%AppData%\Install\Host.exe
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
true
-
offline_keylogger
true
-
password
Password234
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 11 IoCs
Processes:
resource yara_rule behavioral1/memory/1864-84-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1864-85-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1864-86-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1864-88-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1864-89-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1864-90-0x000000000040242D-mapping.dmp netwire behavioral1/memory/1864-94-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1864-98-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1732-125-0x000000000040242D-mapping.dmp netwire behavioral1/memory/1732-129-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1732-131-0x0000000000400000-0x0000000000433000-memory.dmp netwire -
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 4 1400 EQNEDT32.EXE -
Downloads MZ/PE file
-
Executes dropped EXE 4 IoCs
Processes:
svchost_regasm.exesvchost_regasm.exeHost.exeHost.exepid process 768 svchost_regasm.exe 1864 svchost_regasm.exe 1204 Host.exe 1732 Host.exe -
Loads dropped DLL 7 IoCs
Processes:
EQNEDT32.EXEsvchost_regasm.exepid process 1400 EQNEDT32.EXE 1400 EQNEDT32.EXE 1400 EQNEDT32.EXE 1400 EQNEDT32.EXE 1400 EQNEDT32.EXE 1864 svchost_regasm.exe 1864 svchost_regasm.exe -
Drops file in System32 directory 2 IoCs
Processes:
powershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
svchost_regasm.exeHost.exedescription pid process target process PID 768 set thread context of 1864 768 svchost_regasm.exe svchost_regasm.exe PID 1204 set thread context of 1732 1204 Host.exe Host.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
EXCEL.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE -
Modifies registry class 64 IoCs
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597} EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1652 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
svchost_regasm.exepowershell.exeHost.exepowershell.exepid process 768 svchost_regasm.exe 768 svchost_regasm.exe 768 svchost_regasm.exe 768 svchost_regasm.exe 768 svchost_regasm.exe 768 svchost_regasm.exe 1096 powershell.exe 1204 Host.exe 1788 powershell.exe 1204 Host.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
svchost_regasm.exepowershell.exeHost.exepowershell.exedescription pid process Token: SeDebugPrivilege 768 svchost_regasm.exe Token: SeDebugPrivilege 1096 powershell.exe Token: SeDebugPrivilege 1204 Host.exe Token: SeDebugPrivilege 1788 powershell.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1652 EXCEL.EXE 1652 EXCEL.EXE 1652 EXCEL.EXE -
Suspicious use of WriteProcessMemory 48 IoCs
Processes:
EQNEDT32.EXEsvchost_regasm.exesvchost_regasm.exeHost.exedescription pid process target process PID 1400 wrote to memory of 768 1400 EQNEDT32.EXE svchost_regasm.exe PID 1400 wrote to memory of 768 1400 EQNEDT32.EXE svchost_regasm.exe PID 1400 wrote to memory of 768 1400 EQNEDT32.EXE svchost_regasm.exe PID 1400 wrote to memory of 768 1400 EQNEDT32.EXE svchost_regasm.exe PID 768 wrote to memory of 1096 768 svchost_regasm.exe powershell.exe PID 768 wrote to memory of 1096 768 svchost_regasm.exe powershell.exe PID 768 wrote to memory of 1096 768 svchost_regasm.exe powershell.exe PID 768 wrote to memory of 1096 768 svchost_regasm.exe powershell.exe PID 768 wrote to memory of 628 768 svchost_regasm.exe schtasks.exe PID 768 wrote to memory of 628 768 svchost_regasm.exe schtasks.exe PID 768 wrote to memory of 628 768 svchost_regasm.exe schtasks.exe PID 768 wrote to memory of 628 768 svchost_regasm.exe schtasks.exe PID 768 wrote to memory of 1864 768 svchost_regasm.exe svchost_regasm.exe PID 768 wrote to memory of 1864 768 svchost_regasm.exe svchost_regasm.exe PID 768 wrote to memory of 1864 768 svchost_regasm.exe svchost_regasm.exe PID 768 wrote to memory of 1864 768 svchost_regasm.exe svchost_regasm.exe PID 768 wrote to memory of 1864 768 svchost_regasm.exe svchost_regasm.exe PID 768 wrote to memory of 1864 768 svchost_regasm.exe svchost_regasm.exe PID 768 wrote to memory of 1864 768 svchost_regasm.exe svchost_regasm.exe PID 768 wrote to memory of 1864 768 svchost_regasm.exe svchost_regasm.exe PID 768 wrote to memory of 1864 768 svchost_regasm.exe svchost_regasm.exe PID 768 wrote to memory of 1864 768 svchost_regasm.exe svchost_regasm.exe PID 768 wrote to memory of 1864 768 svchost_regasm.exe svchost_regasm.exe PID 768 wrote to memory of 1864 768 svchost_regasm.exe svchost_regasm.exe PID 1864 wrote to memory of 1204 1864 svchost_regasm.exe Host.exe PID 1864 wrote to memory of 1204 1864 svchost_regasm.exe Host.exe PID 1864 wrote to memory of 1204 1864 svchost_regasm.exe Host.exe PID 1864 wrote to memory of 1204 1864 svchost_regasm.exe Host.exe PID 1204 wrote to memory of 1788 1204 Host.exe powershell.exe PID 1204 wrote to memory of 1788 1204 Host.exe powershell.exe PID 1204 wrote to memory of 1788 1204 Host.exe powershell.exe PID 1204 wrote to memory of 1788 1204 Host.exe powershell.exe PID 1204 wrote to memory of 1764 1204 Host.exe schtasks.exe PID 1204 wrote to memory of 1764 1204 Host.exe schtasks.exe PID 1204 wrote to memory of 1764 1204 Host.exe schtasks.exe PID 1204 wrote to memory of 1764 1204 Host.exe schtasks.exe PID 1204 wrote to memory of 1732 1204 Host.exe Host.exe PID 1204 wrote to memory of 1732 1204 Host.exe Host.exe PID 1204 wrote to memory of 1732 1204 Host.exe Host.exe PID 1204 wrote to memory of 1732 1204 Host.exe Host.exe PID 1204 wrote to memory of 1732 1204 Host.exe Host.exe PID 1204 wrote to memory of 1732 1204 Host.exe Host.exe PID 1204 wrote to memory of 1732 1204 Host.exe Host.exe PID 1204 wrote to memory of 1732 1204 Host.exe Host.exe PID 1204 wrote to memory of 1732 1204 Host.exe Host.exe PID 1204 wrote to memory of 1732 1204 Host.exe Host.exe PID 1204 wrote to memory of 1732 1204 Host.exe Host.exe PID 1204 wrote to memory of 1732 1204 Host.exe Host.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\PO -002784.xlsx"1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\svchost_regasm.exe"C:\Users\Public\svchost_regasm.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\QrFwdapUjOrhP.exe"3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QrFwdapUjOrhP" /XML "C:\Users\Admin\AppData\Local\Temp\tmp64CC.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Public\svchost_regasm.exe"C:\Users\Public\svchost_regasm.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\QrFwdapUjOrhP.exe"5⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QrFwdapUjOrhP" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4D18.tmp"5⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"5⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp4D18.tmpFilesize
1KB
MD5bd6751feb128b572f339886f49f88799
SHA1192dfe5b77a12ef15abac9fc056d77981e77085a
SHA2566d3908bae70438d1364f7f091a4c06fe35997c7c24d872800359dc899bc94e68
SHA5125dddff7104ccab1549159c3074a737bad19de6b0bf344f309d3d31ab4c56d5c389fe156fc66037785de5d1c14d921bf55274e387a85dc08fe89708a6171a98ad
-
C:\Users\Admin\AppData\Local\Temp\tmp64CC.tmpFilesize
1KB
MD5bd6751feb128b572f339886f49f88799
SHA1192dfe5b77a12ef15abac9fc056d77981e77085a
SHA2566d3908bae70438d1364f7f091a4c06fe35997c7c24d872800359dc899bc94e68
SHA5125dddff7104ccab1549159c3074a737bad19de6b0bf344f309d3d31ab4c56d5c389fe156fc66037785de5d1c14d921bf55274e387a85dc08fe89708a6171a98ad
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
696KB
MD5e40fb6f7b8378a9d0606cfac8eb60f5d
SHA1b8da9767ceeec76d7b465db3ad098f740f97c35e
SHA256024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0
SHA5129225c4526c93480377c1fa60021fa541014e83768ae265d76f9db5e5556e23255d0083946bdff732cd84efd1ac563cc69265131ea677804f42ec2367db2bcba0
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
696KB
MD5e40fb6f7b8378a9d0606cfac8eb60f5d
SHA1b8da9767ceeec76d7b465db3ad098f740f97c35e
SHA256024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0
SHA5129225c4526c93480377c1fa60021fa541014e83768ae265d76f9db5e5556e23255d0083946bdff732cd84efd1ac563cc69265131ea677804f42ec2367db2bcba0
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
696KB
MD5e40fb6f7b8378a9d0606cfac8eb60f5d
SHA1b8da9767ceeec76d7b465db3ad098f740f97c35e
SHA256024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0
SHA5129225c4526c93480377c1fa60021fa541014e83768ae265d76f9db5e5556e23255d0083946bdff732cd84efd1ac563cc69265131ea677804f42ec2367db2bcba0
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD5363f1bc3da63195cd557e277a8cb8a52
SHA134701b0e721d9b14e9bdfdaca8aa3736d29130c8
SHA256daf80253e279998ef7020983ecbe240ecbbb9e4f0c8460628b5c7846aa36766e
SHA51265fc20607bb7804dd8157ce4ebbac331329496736fc57a1cea0a3a7b29cea869f02991d870fe168569125ba7d667ea45e410f97953bd952905d17ea3674d59e3
-
C:\Users\Public\svchost_regasm.exeFilesize
696KB
MD5e40fb6f7b8378a9d0606cfac8eb60f5d
SHA1b8da9767ceeec76d7b465db3ad098f740f97c35e
SHA256024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0
SHA5129225c4526c93480377c1fa60021fa541014e83768ae265d76f9db5e5556e23255d0083946bdff732cd84efd1ac563cc69265131ea677804f42ec2367db2bcba0
-
C:\Users\Public\svchost_regasm.exeFilesize
696KB
MD5e40fb6f7b8378a9d0606cfac8eb60f5d
SHA1b8da9767ceeec76d7b465db3ad098f740f97c35e
SHA256024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0
SHA5129225c4526c93480377c1fa60021fa541014e83768ae265d76f9db5e5556e23255d0083946bdff732cd84efd1ac563cc69265131ea677804f42ec2367db2bcba0
-
C:\Users\Public\svchost_regasm.exeFilesize
696KB
MD5e40fb6f7b8378a9d0606cfac8eb60f5d
SHA1b8da9767ceeec76d7b465db3ad098f740f97c35e
SHA256024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0
SHA5129225c4526c93480377c1fa60021fa541014e83768ae265d76f9db5e5556e23255d0083946bdff732cd84efd1ac563cc69265131ea677804f42ec2367db2bcba0
-
\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
696KB
MD5e40fb6f7b8378a9d0606cfac8eb60f5d
SHA1b8da9767ceeec76d7b465db3ad098f740f97c35e
SHA256024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0
SHA5129225c4526c93480377c1fa60021fa541014e83768ae265d76f9db5e5556e23255d0083946bdff732cd84efd1ac563cc69265131ea677804f42ec2367db2bcba0
-
\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
696KB
MD5e40fb6f7b8378a9d0606cfac8eb60f5d
SHA1b8da9767ceeec76d7b465db3ad098f740f97c35e
SHA256024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0
SHA5129225c4526c93480377c1fa60021fa541014e83768ae265d76f9db5e5556e23255d0083946bdff732cd84efd1ac563cc69265131ea677804f42ec2367db2bcba0
-
\Users\Public\svchost_regasm.exeFilesize
696KB
MD5e40fb6f7b8378a9d0606cfac8eb60f5d
SHA1b8da9767ceeec76d7b465db3ad098f740f97c35e
SHA256024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0
SHA5129225c4526c93480377c1fa60021fa541014e83768ae265d76f9db5e5556e23255d0083946bdff732cd84efd1ac563cc69265131ea677804f42ec2367db2bcba0
-
\Users\Public\svchost_regasm.exeFilesize
696KB
MD5e40fb6f7b8378a9d0606cfac8eb60f5d
SHA1b8da9767ceeec76d7b465db3ad098f740f97c35e
SHA256024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0
SHA5129225c4526c93480377c1fa60021fa541014e83768ae265d76f9db5e5556e23255d0083946bdff732cd84efd1ac563cc69265131ea677804f42ec2367db2bcba0
-
\Users\Public\svchost_regasm.exeFilesize
696KB
MD5e40fb6f7b8378a9d0606cfac8eb60f5d
SHA1b8da9767ceeec76d7b465db3ad098f740f97c35e
SHA256024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0
SHA5129225c4526c93480377c1fa60021fa541014e83768ae265d76f9db5e5556e23255d0083946bdff732cd84efd1ac563cc69265131ea677804f42ec2367db2bcba0
-
\Users\Public\svchost_regasm.exeFilesize
696KB
MD5e40fb6f7b8378a9d0606cfac8eb60f5d
SHA1b8da9767ceeec76d7b465db3ad098f740f97c35e
SHA256024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0
SHA5129225c4526c93480377c1fa60021fa541014e83768ae265d76f9db5e5556e23255d0083946bdff732cd84efd1ac563cc69265131ea677804f42ec2367db2bcba0
-
\Users\Public\svchost_regasm.exeFilesize
696KB
MD5e40fb6f7b8378a9d0606cfac8eb60f5d
SHA1b8da9767ceeec76d7b465db3ad098f740f97c35e
SHA256024720abbe74c6d8e81fb5aacde66f0526a3ed4f7300e14f0ff0599bbaa2cde0
SHA5129225c4526c93480377c1fa60021fa541014e83768ae265d76f9db5e5556e23255d0083946bdff732cd84efd1ac563cc69265131ea677804f42ec2367db2bcba0
-
memory/628-75-0x0000000000000000-mapping.dmp
-
memory/768-65-0x0000000000000000-mapping.dmp
-
memory/768-68-0x0000000000050000-0x0000000000104000-memory.dmpFilesize
720KB
-
memory/768-70-0x0000000000500000-0x0000000000516000-memory.dmpFilesize
88KB
-
memory/768-72-0x0000000000520000-0x000000000052A000-memory.dmpFilesize
40KB
-
memory/768-73-0x00000000053A0000-0x0000000005420000-memory.dmpFilesize
512KB
-
memory/768-78-0x0000000004F10000-0x0000000004F42000-memory.dmpFilesize
200KB
-
memory/1096-103-0x0000000066710000-0x0000000066CBB000-memory.dmpFilesize
5.7MB
-
memory/1096-104-0x0000000066710000-0x0000000066CBB000-memory.dmpFilesize
5.7MB
-
memory/1096-74-0x0000000000000000-mapping.dmp
-
memory/1204-112-0x0000000004840000-0x0000000004872000-memory.dmpFilesize
200KB
-
memory/1204-101-0x0000000000C40000-0x0000000000CF4000-memory.dmpFilesize
720KB
-
memory/1204-97-0x0000000000000000-mapping.dmp
-
memory/1652-106-0x000000007227D000-0x0000000072288000-memory.dmpFilesize
44KB
-
memory/1652-56-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1652-57-0x000000007227D000-0x0000000072288000-memory.dmpFilesize
44KB
-
memory/1652-54-0x000000002F121000-0x000000002F124000-memory.dmpFilesize
12KB
-
memory/1652-105-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1652-55-0x0000000071291000-0x0000000071293000-memory.dmpFilesize
8KB
-
memory/1652-71-0x000000007227D000-0x0000000072288000-memory.dmpFilesize
44KB
-
memory/1652-58-0x00000000756B1000-0x00000000756B3000-memory.dmpFilesize
8KB
-
memory/1732-125-0x000000000040242D-mapping.dmp
-
memory/1732-129-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1732-131-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1764-108-0x0000000000000000-mapping.dmp
-
memory/1788-107-0x0000000000000000-mapping.dmp
-
memory/1788-130-0x0000000073260000-0x000000007380B000-memory.dmpFilesize
5.7MB
-
memory/1788-113-0x0000000073260000-0x000000007380B000-memory.dmpFilesize
5.7MB
-
memory/1864-90-0x000000000040242D-mapping.dmp
-
memory/1864-82-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1864-80-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1864-98-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1864-89-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1864-94-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1864-88-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1864-86-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1864-85-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1864-79-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1864-84-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB