Analysis
-
max time kernel
151s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
08-08-2022 15:18
Static task
static1
Behavioral task
behavioral1
Sample
PAYSLP18500USD.xlsx
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
PAYSLP18500USD.xlsx
Resource
win10v2004-20220721-en
General
-
Target
PAYSLP18500USD.xlsx
-
Size
680KB
-
MD5
93d65d182bdf8a2e9e5d38d1661f3bb7
-
SHA1
9e21b2b8f08cdaeb810c64762210687ecd1d84df
-
SHA256
38770a1d7fb564d852c3f22d70f6e4cf3f24a0e5240f96ebf3d2c017af671618
-
SHA512
1c2c78d4abbc2cadf8620e2105d1474fd1144789ad0c98eb0da9221a8b83742408222c03d71f9a646db40590a1d60441c6258443c1e005085bd49a1abf2deb48
Malware Config
Extracted
remcos
Mekino Aug
mekremcos23.freedynamicdns.net:2397
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
os.exe
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
true
-
install_path
%AppData%
-
keylog_crypt
true
-
keylog_file
logs.dat
-
keylog_flag
false
-
mouse_option
false
-
mutex
Rmc-ZCU1S6
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
ecv
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 1 1232 EQNEDT32.EXE -
Downloads MZ/PE file
-
Executes dropped EXE 4 IoCs
Processes:
SDE.exeSDE.exeos.exeos.exepid process 1268 SDE.exe 1376 SDE.exe 320 os.exe 1656 os.exe -
Loads dropped DLL 2 IoCs
Processes:
EQNEDT32.EXEcmd.exepid process 1232 EQNEDT32.EXE 648 cmd.exe -
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
os.exeSDE.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ os.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ecv = "\"C:\\Users\\Admin\\AppData\\Roaming\\os.exe\"" os.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Windows\CurrentVersion\Run\ SDE.exe Set value (str) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Windows\CurrentVersion\Run\ecv = "\"C:\\Users\\Admin\\AppData\\Roaming\\os.exe\"" SDE.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ SDE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ecv = "\"C:\\Users\\Admin\\AppData\\Roaming\\os.exe\"" SDE.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Windows\CurrentVersion\Run\ os.exe Set value (str) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Windows\CurrentVersion\Run\ecv = "\"C:\\Users\\Admin\\AppData\\Roaming\\os.exe\"" os.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
SDE.exeos.exedescription pid process target process PID 1268 set thread context of 1376 1268 SDE.exe SDE.exe PID 320 set thread context of 1656 320 os.exe os.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" EXCEL.EXE -
Modifies registry class 64 IoCs
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1672 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
EXCEL.EXEos.exepid process 1672 EXCEL.EXE 1672 EXCEL.EXE 1672 EXCEL.EXE 1656 os.exe -
Suspicious use of WriteProcessMemory 42 IoCs
Processes:
EQNEDT32.EXESDE.exeSDE.exeWScript.execmd.exeos.exedescription pid process target process PID 1232 wrote to memory of 1268 1232 EQNEDT32.EXE SDE.exe PID 1232 wrote to memory of 1268 1232 EQNEDT32.EXE SDE.exe PID 1232 wrote to memory of 1268 1232 EQNEDT32.EXE SDE.exe PID 1232 wrote to memory of 1268 1232 EQNEDT32.EXE SDE.exe PID 1268 wrote to memory of 1376 1268 SDE.exe SDE.exe PID 1268 wrote to memory of 1376 1268 SDE.exe SDE.exe PID 1268 wrote to memory of 1376 1268 SDE.exe SDE.exe PID 1268 wrote to memory of 1376 1268 SDE.exe SDE.exe PID 1268 wrote to memory of 1376 1268 SDE.exe SDE.exe PID 1268 wrote to memory of 1376 1268 SDE.exe SDE.exe PID 1268 wrote to memory of 1376 1268 SDE.exe SDE.exe PID 1268 wrote to memory of 1376 1268 SDE.exe SDE.exe PID 1268 wrote to memory of 1376 1268 SDE.exe SDE.exe PID 1268 wrote to memory of 1376 1268 SDE.exe SDE.exe PID 1268 wrote to memory of 1376 1268 SDE.exe SDE.exe PID 1268 wrote to memory of 1376 1268 SDE.exe SDE.exe PID 1268 wrote to memory of 1376 1268 SDE.exe SDE.exe PID 1376 wrote to memory of 1792 1376 SDE.exe WScript.exe PID 1376 wrote to memory of 1792 1376 SDE.exe WScript.exe PID 1376 wrote to memory of 1792 1376 SDE.exe WScript.exe PID 1376 wrote to memory of 1792 1376 SDE.exe WScript.exe PID 1792 wrote to memory of 648 1792 WScript.exe cmd.exe PID 1792 wrote to memory of 648 1792 WScript.exe cmd.exe PID 1792 wrote to memory of 648 1792 WScript.exe cmd.exe PID 1792 wrote to memory of 648 1792 WScript.exe cmd.exe PID 648 wrote to memory of 320 648 cmd.exe os.exe PID 648 wrote to memory of 320 648 cmd.exe os.exe PID 648 wrote to memory of 320 648 cmd.exe os.exe PID 648 wrote to memory of 320 648 cmd.exe os.exe PID 320 wrote to memory of 1656 320 os.exe os.exe PID 320 wrote to memory of 1656 320 os.exe os.exe PID 320 wrote to memory of 1656 320 os.exe os.exe PID 320 wrote to memory of 1656 320 os.exe os.exe PID 320 wrote to memory of 1656 320 os.exe os.exe PID 320 wrote to memory of 1656 320 os.exe os.exe PID 320 wrote to memory of 1656 320 os.exe os.exe PID 320 wrote to memory of 1656 320 os.exe os.exe PID 320 wrote to memory of 1656 320 os.exe os.exe PID 320 wrote to memory of 1656 320 os.exe os.exe PID 320 wrote to memory of 1656 320 os.exe os.exe PID 320 wrote to memory of 1656 320 os.exe os.exe PID 320 wrote to memory of 1656 320 os.exe os.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\PAYSLP18500USD.xlsx1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\SDE.exe"C:\Users\Admin\AppData\Roaming\SDE.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\SDE.exe"C:\Users\Admin\AppData\Roaming\SDE.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\os.exe"5⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\os.exeC:\Users\Admin\AppData\Roaming\os.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\os.exe"C:\Users\Admin\AppData\Roaming\os.exe"7⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\install.vbsFilesize
396B
MD5c17638c9a95f8295057e1a1902820a14
SHA1808ee46f81e5d748cd4c7ead5dfb7cea52b1d027
SHA256372934f440f94377066062d33d18589db5ea2ab733d74ba14bff6b9e3519706e
SHA51286093a6bc3d1e8179ce9d9ff07660e057b6d2f9687140c18d354ad2f73f0bcc9f570fbeb0b15a6dae7535b002436893cb937d3504ec5c8009be1d45370bd78db
-
C:\Users\Admin\AppData\Roaming\SDE.exeFilesize
879KB
MD53b0459dfb384c1285141f4e03f89ff03
SHA136d9ed9b3b77c1d67b7001c22be4219e79b2ab56
SHA2564be4c2cbf4c527636cda35174fac8b99a00e157c78a1bc574b9cb905cf85dfb7
SHA512d1c9d023791c4111b8d7d842dd5d2fee2b293686c83ada222853eb35e35d22f9ed3b463070dd4e7a21fa17465689bbc023f7165802b4ae17596d06a4779cf360
-
C:\Users\Admin\AppData\Roaming\SDE.exeFilesize
879KB
MD53b0459dfb384c1285141f4e03f89ff03
SHA136d9ed9b3b77c1d67b7001c22be4219e79b2ab56
SHA2564be4c2cbf4c527636cda35174fac8b99a00e157c78a1bc574b9cb905cf85dfb7
SHA512d1c9d023791c4111b8d7d842dd5d2fee2b293686c83ada222853eb35e35d22f9ed3b463070dd4e7a21fa17465689bbc023f7165802b4ae17596d06a4779cf360
-
C:\Users\Admin\AppData\Roaming\SDE.exeFilesize
879KB
MD53b0459dfb384c1285141f4e03f89ff03
SHA136d9ed9b3b77c1d67b7001c22be4219e79b2ab56
SHA2564be4c2cbf4c527636cda35174fac8b99a00e157c78a1bc574b9cb905cf85dfb7
SHA512d1c9d023791c4111b8d7d842dd5d2fee2b293686c83ada222853eb35e35d22f9ed3b463070dd4e7a21fa17465689bbc023f7165802b4ae17596d06a4779cf360
-
C:\Users\Admin\AppData\Roaming\os.exeFilesize
879KB
MD53b0459dfb384c1285141f4e03f89ff03
SHA136d9ed9b3b77c1d67b7001c22be4219e79b2ab56
SHA2564be4c2cbf4c527636cda35174fac8b99a00e157c78a1bc574b9cb905cf85dfb7
SHA512d1c9d023791c4111b8d7d842dd5d2fee2b293686c83ada222853eb35e35d22f9ed3b463070dd4e7a21fa17465689bbc023f7165802b4ae17596d06a4779cf360
-
C:\Users\Admin\AppData\Roaming\os.exeFilesize
879KB
MD53b0459dfb384c1285141f4e03f89ff03
SHA136d9ed9b3b77c1d67b7001c22be4219e79b2ab56
SHA2564be4c2cbf4c527636cda35174fac8b99a00e157c78a1bc574b9cb905cf85dfb7
SHA512d1c9d023791c4111b8d7d842dd5d2fee2b293686c83ada222853eb35e35d22f9ed3b463070dd4e7a21fa17465689bbc023f7165802b4ae17596d06a4779cf360
-
C:\Users\Admin\AppData\Roaming\os.exeFilesize
879KB
MD53b0459dfb384c1285141f4e03f89ff03
SHA136d9ed9b3b77c1d67b7001c22be4219e79b2ab56
SHA2564be4c2cbf4c527636cda35174fac8b99a00e157c78a1bc574b9cb905cf85dfb7
SHA512d1c9d023791c4111b8d7d842dd5d2fee2b293686c83ada222853eb35e35d22f9ed3b463070dd4e7a21fa17465689bbc023f7165802b4ae17596d06a4779cf360
-
\Users\Admin\AppData\Roaming\SDE.exeFilesize
879KB
MD53b0459dfb384c1285141f4e03f89ff03
SHA136d9ed9b3b77c1d67b7001c22be4219e79b2ab56
SHA2564be4c2cbf4c527636cda35174fac8b99a00e157c78a1bc574b9cb905cf85dfb7
SHA512d1c9d023791c4111b8d7d842dd5d2fee2b293686c83ada222853eb35e35d22f9ed3b463070dd4e7a21fa17465689bbc023f7165802b4ae17596d06a4779cf360
-
\Users\Admin\AppData\Roaming\os.exeFilesize
879KB
MD53b0459dfb384c1285141f4e03f89ff03
SHA136d9ed9b3b77c1d67b7001c22be4219e79b2ab56
SHA2564be4c2cbf4c527636cda35174fac8b99a00e157c78a1bc574b9cb905cf85dfb7
SHA512d1c9d023791c4111b8d7d842dd5d2fee2b293686c83ada222853eb35e35d22f9ed3b463070dd4e7a21fa17465689bbc023f7165802b4ae17596d06a4779cf360
-
memory/320-97-0x0000000001070000-0x0000000001152000-memory.dmpFilesize
904KB
-
memory/320-95-0x0000000000000000-mapping.dmp
-
memory/648-92-0x0000000000000000-mapping.dmp
-
memory/1268-66-0x00000000003F0000-0x0000000000408000-memory.dmpFilesize
96KB
-
memory/1268-68-0x0000000005390000-0x0000000005454000-memory.dmpFilesize
784KB
-
memory/1268-61-0x0000000000000000-mapping.dmp
-
memory/1268-64-0x0000000000EC0000-0x0000000000FA2000-memory.dmpFilesize
904KB
-
memory/1268-69-0x00000000054A0000-0x000000000551C000-memory.dmpFilesize
496KB
-
memory/1376-89-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/1376-80-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/1376-77-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/1376-78-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/1376-82-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/1376-75-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/1376-83-0x0000000000431BE8-mapping.dmp
-
memory/1376-70-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/1376-87-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/1376-71-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/1376-73-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/1376-76-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/1656-117-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/1656-120-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/1656-112-0x0000000000431BE8-mapping.dmp
-
memory/1672-67-0x000000007206D000-0x0000000072078000-memory.dmpFilesize
44KB
-
memory/1672-57-0x000000007206D000-0x0000000072078000-memory.dmpFilesize
44KB
-
memory/1672-56-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1672-58-0x00000000762B1000-0x00000000762B3000-memory.dmpFilesize
8KB
-
memory/1672-55-0x0000000071081000-0x0000000071083000-memory.dmpFilesize
8KB
-
memory/1672-54-0x000000002F881000-0x000000002F884000-memory.dmpFilesize
12KB
-
memory/1672-118-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1672-119-0x000000007206D000-0x0000000072078000-memory.dmpFilesize
44KB
-
memory/1792-88-0x0000000000000000-mapping.dmp