Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
09-08-2022 12:02
Static task
static1
Behavioral task
behavioral1
Sample
NOTICE - INVITATION FOR APPLICATIONS TO INVEST IN FACILITIES (3).xlsx
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
NOTICE - INVITATION FOR APPLICATIONS TO INVEST IN FACILITIES (3).xlsx
Resource
win10v2004-20220721-en
General
-
Target
NOTICE - INVITATION FOR APPLICATIONS TO INVEST IN FACILITIES (3).xlsx
-
Size
622KB
-
MD5
d0d7385e1050915b4eef59aa87bfeed3
-
SHA1
e940a6ae1c3dc61c2baf9167109b4bb5e66f7111
-
SHA256
5eca8a01c785c85dae69d88d2a679824f90bd0f170340840b30f54a8e6889946
-
SHA512
2d1b6ce578f15ef4dec07b6676429c64f6b006ce37411e300f1d63f7887b7d1de2e18c4e9eb9235079a921d0b987246e8ae9aeae89442b7389ac0a22879952a1
Malware Config
Extracted
remcos
Awele
gdyhjjdhbvxgsfe.gotdns.ch:2718
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
doc.exe
-
delete_file
false
-
hide_file
true
-
hide_keylog_file
true
-
install_flag
true
-
install_path
%AppData%
-
keylog_crypt
true
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Remcos-MUG074
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
wix
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
notepad;solitaire;
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 1 280 EQNEDT32.EXE -
Downloads MZ/PE file
-
Executes dropped EXE 5 IoCs
Processes:
MMN.exeMMN.exedoc.exedoc.exedoc.exepid process 1712 MMN.exe 1008 MMN.exe 1572 doc.exe 1716 doc.exe 1668 doc.exe -
Loads dropped DLL 2 IoCs
Processes:
EQNEDT32.EXEcmd.exepid process 280 EQNEDT32.EXE 1780 cmd.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
MMN.exedoc.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Windows\CurrentVersion\Run\ MMN.exe Set value (str) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Windows\CurrentVersion\Run\wix = "\"C:\\Users\\Admin\\AppData\\Roaming\\doc.exe\"" MMN.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Windows\CurrentVersion\Run\ doc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Windows\CurrentVersion\Run\wix = "\"C:\\Users\\Admin\\AppData\\Roaming\\doc.exe\"" doc.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
MMN.exedoc.exedescription pid process target process PID 1712 set thread context of 1008 1712 MMN.exe MMN.exe PID 1572 set thread context of 1668 1572 doc.exe doc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
EXCEL.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE -
Modifies registry class 64 IoCs
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit" EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 972 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
doc.exepid process 1572 doc.exe 1572 doc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
doc.exedescription pid process Token: SeDebugPrivilege 1572 doc.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
EXCEL.EXEdoc.exepid process 972 EXCEL.EXE 972 EXCEL.EXE 972 EXCEL.EXE 1668 doc.exe -
Suspicious use of WriteProcessMemory 46 IoCs
Processes:
EQNEDT32.EXEMMN.exeMMN.exeWScript.execmd.exedoc.exedescription pid process target process PID 280 wrote to memory of 1712 280 EQNEDT32.EXE MMN.exe PID 280 wrote to memory of 1712 280 EQNEDT32.EXE MMN.exe PID 280 wrote to memory of 1712 280 EQNEDT32.EXE MMN.exe PID 280 wrote to memory of 1712 280 EQNEDT32.EXE MMN.exe PID 1712 wrote to memory of 1008 1712 MMN.exe MMN.exe PID 1712 wrote to memory of 1008 1712 MMN.exe MMN.exe PID 1712 wrote to memory of 1008 1712 MMN.exe MMN.exe PID 1712 wrote to memory of 1008 1712 MMN.exe MMN.exe PID 1712 wrote to memory of 1008 1712 MMN.exe MMN.exe PID 1712 wrote to memory of 1008 1712 MMN.exe MMN.exe PID 1712 wrote to memory of 1008 1712 MMN.exe MMN.exe PID 1712 wrote to memory of 1008 1712 MMN.exe MMN.exe PID 1712 wrote to memory of 1008 1712 MMN.exe MMN.exe PID 1712 wrote to memory of 1008 1712 MMN.exe MMN.exe PID 1712 wrote to memory of 1008 1712 MMN.exe MMN.exe PID 1712 wrote to memory of 1008 1712 MMN.exe MMN.exe PID 1712 wrote to memory of 1008 1712 MMN.exe MMN.exe PID 1008 wrote to memory of 808 1008 MMN.exe WScript.exe PID 1008 wrote to memory of 808 1008 MMN.exe WScript.exe PID 1008 wrote to memory of 808 1008 MMN.exe WScript.exe PID 1008 wrote to memory of 808 1008 MMN.exe WScript.exe PID 808 wrote to memory of 1780 808 WScript.exe cmd.exe PID 808 wrote to memory of 1780 808 WScript.exe cmd.exe PID 808 wrote to memory of 1780 808 WScript.exe cmd.exe PID 808 wrote to memory of 1780 808 WScript.exe cmd.exe PID 1780 wrote to memory of 1572 1780 cmd.exe doc.exe PID 1780 wrote to memory of 1572 1780 cmd.exe doc.exe PID 1780 wrote to memory of 1572 1780 cmd.exe doc.exe PID 1780 wrote to memory of 1572 1780 cmd.exe doc.exe PID 1572 wrote to memory of 1716 1572 doc.exe doc.exe PID 1572 wrote to memory of 1716 1572 doc.exe doc.exe PID 1572 wrote to memory of 1716 1572 doc.exe doc.exe PID 1572 wrote to memory of 1716 1572 doc.exe doc.exe PID 1572 wrote to memory of 1668 1572 doc.exe doc.exe PID 1572 wrote to memory of 1668 1572 doc.exe doc.exe PID 1572 wrote to memory of 1668 1572 doc.exe doc.exe PID 1572 wrote to memory of 1668 1572 doc.exe doc.exe PID 1572 wrote to memory of 1668 1572 doc.exe doc.exe PID 1572 wrote to memory of 1668 1572 doc.exe doc.exe PID 1572 wrote to memory of 1668 1572 doc.exe doc.exe PID 1572 wrote to memory of 1668 1572 doc.exe doc.exe PID 1572 wrote to memory of 1668 1572 doc.exe doc.exe PID 1572 wrote to memory of 1668 1572 doc.exe doc.exe PID 1572 wrote to memory of 1668 1572 doc.exe doc.exe PID 1572 wrote to memory of 1668 1572 doc.exe doc.exe PID 1572 wrote to memory of 1668 1572 doc.exe doc.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\NOTICE - INVITATION FOR APPLICATIONS TO INVEST IN FACILITIES (3).xlsx"1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\MMN.exe"C:\Users\Admin\AppData\Roaming\MMN.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\MMN.exe"C:\Users\Admin\AppData\Roaming\MMN.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\doc.exe"5⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\doc.exeC:\Users\Admin\AppData\Roaming\doc.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\doc.exe"C:\Users\Admin\AppData\Roaming\doc.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\doc.exe"C:\Users\Admin\AppData\Roaming\doc.exe"7⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\install.vbsFilesize
398B
MD5ee037af4f67b0176ee7d1807f022765b
SHA1c7266a67119240aac45b1eb740192af03a79ef08
SHA2564824321b225b2cec848e1f0019769215bc2120ff4886cb9f1c29e82935971069
SHA512324733c00bea68799b98edfa9083aaca147ff873b4272bc507ef00a6e2bc4bdd9aaf0df762c7a7e343fdfedb3fa8fc3682209abad55e2c351bc22e683dce71f7
-
C:\Users\Admin\AppData\Roaming\MMN.exeFilesize
814KB
MD565fd959ae12d80950c6ab708fc5329d1
SHA1ae4dc791daf597f1123fbc700f896cdfa9823041
SHA2568a791c71f76f530179c8e957f5b6235fb573a9ee35a1dabfca368e62f7bba29e
SHA51241ca3eb10ff9f4ae1d30885159a2d65694eaed11f8f363237511adc22f6a7001b36dd293d04bf73f05e1f6b886a9c26d73fce04a2fb1023b40738ca2e7c02141
-
C:\Users\Admin\AppData\Roaming\MMN.exeFilesize
814KB
MD565fd959ae12d80950c6ab708fc5329d1
SHA1ae4dc791daf597f1123fbc700f896cdfa9823041
SHA2568a791c71f76f530179c8e957f5b6235fb573a9ee35a1dabfca368e62f7bba29e
SHA51241ca3eb10ff9f4ae1d30885159a2d65694eaed11f8f363237511adc22f6a7001b36dd293d04bf73f05e1f6b886a9c26d73fce04a2fb1023b40738ca2e7c02141
-
C:\Users\Admin\AppData\Roaming\MMN.exeFilesize
814KB
MD565fd959ae12d80950c6ab708fc5329d1
SHA1ae4dc791daf597f1123fbc700f896cdfa9823041
SHA2568a791c71f76f530179c8e957f5b6235fb573a9ee35a1dabfca368e62f7bba29e
SHA51241ca3eb10ff9f4ae1d30885159a2d65694eaed11f8f363237511adc22f6a7001b36dd293d04bf73f05e1f6b886a9c26d73fce04a2fb1023b40738ca2e7c02141
-
C:\Users\Admin\AppData\Roaming\doc.exeFilesize
814KB
MD565fd959ae12d80950c6ab708fc5329d1
SHA1ae4dc791daf597f1123fbc700f896cdfa9823041
SHA2568a791c71f76f530179c8e957f5b6235fb573a9ee35a1dabfca368e62f7bba29e
SHA51241ca3eb10ff9f4ae1d30885159a2d65694eaed11f8f363237511adc22f6a7001b36dd293d04bf73f05e1f6b886a9c26d73fce04a2fb1023b40738ca2e7c02141
-
C:\Users\Admin\AppData\Roaming\doc.exeFilesize
814KB
MD565fd959ae12d80950c6ab708fc5329d1
SHA1ae4dc791daf597f1123fbc700f896cdfa9823041
SHA2568a791c71f76f530179c8e957f5b6235fb573a9ee35a1dabfca368e62f7bba29e
SHA51241ca3eb10ff9f4ae1d30885159a2d65694eaed11f8f363237511adc22f6a7001b36dd293d04bf73f05e1f6b886a9c26d73fce04a2fb1023b40738ca2e7c02141
-
C:\Users\Admin\AppData\Roaming\doc.exeFilesize
814KB
MD565fd959ae12d80950c6ab708fc5329d1
SHA1ae4dc791daf597f1123fbc700f896cdfa9823041
SHA2568a791c71f76f530179c8e957f5b6235fb573a9ee35a1dabfca368e62f7bba29e
SHA51241ca3eb10ff9f4ae1d30885159a2d65694eaed11f8f363237511adc22f6a7001b36dd293d04bf73f05e1f6b886a9c26d73fce04a2fb1023b40738ca2e7c02141
-
C:\Users\Admin\AppData\Roaming\doc.exeFilesize
814KB
MD565fd959ae12d80950c6ab708fc5329d1
SHA1ae4dc791daf597f1123fbc700f896cdfa9823041
SHA2568a791c71f76f530179c8e957f5b6235fb573a9ee35a1dabfca368e62f7bba29e
SHA51241ca3eb10ff9f4ae1d30885159a2d65694eaed11f8f363237511adc22f6a7001b36dd293d04bf73f05e1f6b886a9c26d73fce04a2fb1023b40738ca2e7c02141
-
\Users\Admin\AppData\Roaming\MMN.exeFilesize
814KB
MD565fd959ae12d80950c6ab708fc5329d1
SHA1ae4dc791daf597f1123fbc700f896cdfa9823041
SHA2568a791c71f76f530179c8e957f5b6235fb573a9ee35a1dabfca368e62f7bba29e
SHA51241ca3eb10ff9f4ae1d30885159a2d65694eaed11f8f363237511adc22f6a7001b36dd293d04bf73f05e1f6b886a9c26d73fce04a2fb1023b40738ca2e7c02141
-
\Users\Admin\AppData\Roaming\doc.exeFilesize
814KB
MD565fd959ae12d80950c6ab708fc5329d1
SHA1ae4dc791daf597f1123fbc700f896cdfa9823041
SHA2568a791c71f76f530179c8e957f5b6235fb573a9ee35a1dabfca368e62f7bba29e
SHA51241ca3eb10ff9f4ae1d30885159a2d65694eaed11f8f363237511adc22f6a7001b36dd293d04bf73f05e1f6b886a9c26d73fce04a2fb1023b40738ca2e7c02141
-
memory/808-89-0x0000000000000000-mapping.dmp
-
memory/972-67-0x0000000071EFD000-0x0000000071F08000-memory.dmpFilesize
44KB
-
memory/972-54-0x000000002F9D1000-0x000000002F9D4000-memory.dmpFilesize
12KB
-
memory/972-57-0x0000000075D21000-0x0000000075D23000-memory.dmpFilesize
8KB
-
memory/972-56-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/972-55-0x0000000070F11000-0x0000000070F13000-memory.dmpFilesize
8KB
-
memory/972-58-0x0000000071EFD000-0x0000000071F08000-memory.dmpFilesize
44KB
-
memory/1008-90-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/1008-88-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/1008-75-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/1008-78-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/1008-80-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/1008-82-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/1008-83-0x0000000000430F6E-mapping.dmp
-
memory/1008-76-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/1008-87-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/1008-70-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/1008-73-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/1008-77-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/1008-71-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/1572-96-0x0000000000000000-mapping.dmp
-
memory/1572-98-0x0000000000010000-0x00000000000E2000-memory.dmpFilesize
840KB
-
memory/1668-120-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/1668-114-0x0000000000430F6E-mapping.dmp
-
memory/1668-119-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/1712-66-0x0000000000340000-0x0000000000358000-memory.dmpFilesize
96KB
-
memory/1712-69-0x00000000054D0000-0x000000000554A000-memory.dmpFilesize
488KB
-
memory/1712-68-0x0000000005420000-0x00000000054D4000-memory.dmpFilesize
720KB
-
memory/1712-64-0x0000000000AC0000-0x0000000000B92000-memory.dmpFilesize
840KB
-
memory/1712-61-0x0000000000000000-mapping.dmp
-
memory/1780-93-0x0000000000000000-mapping.dmp