85d6b555ded7367b59e072d50f1b0188f1bf462dec4df03e660d5c8b915597e4

General

Target

BOM_431780_23.11.22 - Placements.xls
Size

1.0MB
MD5

58e7c1683df36fe4dddfc8d130fdaa1e
SHA1

f5d764177528466ab54cbd62a63ddfddf45a15b9
SHA256

85d6b555ded7367b59e072d50f1b0188f1bf462dec4df03e660d5c8b915597e4
SHA512

b2f602df2fc632f7da9e84a1298c4631690b33727e03c1a69248dee5c5582bbe9199bf1c7caad7b851d2bfc27de8ade2d9ce6c46403426ea4bc6ee1dfe30afa8
SSDEEP

24576:rr5XXXXXXXXXXXXUXXXXXXXSXXXXXXXX0mHr5XXXXXXXXXXXXUXXXXXXXSXXXXXZ:XPT

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

EQNEDT32.EXE

flow pid process

4 1976 EQNEDT32.EXE
Downloads MZ/PE file
Executes dropped EXE 1 IoCs

Processes:

vbc.exe

pid process

1648 vbc.exe
Loads dropped DLL 1 IoCs

Processes:

EQNEDT32.EXE

pid process

1976 EQNEDT32.EXE
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

flow	pid	process
4	1976	EQNEDT32.EXE

pid	process
1648	vbc.exe

pid	process
1976	EQNEDT32.EXE

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

EXCEL.EXE

description ioc process

Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
exploit

Exploitation for Client Execution
T1203

Processes:

EQNEDT32.EXE

pid process

1976 EQNEDT32.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

pid	process
1976	EQNEDT32.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

EXCEL.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

888 EXCEL.EXE
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1816 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

vbc.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1648 vbc.exe
Token: SeDebugPrivilege 1816 powershell.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

EXCEL.EXE

pid process

888 EXCEL.EXE
888 EXCEL.EXE
888 EXCEL.EXE

pid	process
888	EXCEL.EXE

pid	process
1816	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1648	vbc.exe
Token: SeDebugPrivilege	1816	powershell.exe

pid	process
888	EXCEL.EXE
888	EXCEL.EXE
888	EXCEL.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

EQNEDT32.EXEvbc.exe

description	pid	process	target process
PID 1976 wrote to memory of 1648	1976	EQNEDT32.EXE	vbc.exe
PID 1976 wrote to memory of 1648	1976	EQNEDT32.EXE	vbc.exe
PID 1976 wrote to memory of 1648	1976	EQNEDT32.EXE	vbc.exe
PID 1976 wrote to memory of 1648	1976	EQNEDT32.EXE	vbc.exe
PID 1648 wrote to memory of 1816	1648	vbc.exe	powershell.exe
PID 1648 wrote to memory of 1816	1648	vbc.exe	powershell.exe
PID 1648 wrote to memory of 1816	1648	vbc.exe	powershell.exe
PID 1648 wrote to memory of 1816	1648	vbc.exe	powershell.exe

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\BOM_431780_23.11.22 - Placements.xls"
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:888

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:1976

C:\Users\Public\vbc.exe
"C:\Users\Public\vbc.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1648

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA2AA==
3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1816

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Exploitation for Client Execution

Scripting

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Scripting

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\vbc.exe

Filesize
2.3MB

MD5
238520dfc9517e6ddeb61c218ad72ae7

SHA1
2c7e7f7b5aedc1ad2c6182e70e7a46903eace91c

SHA256
3c48e370ded1c9b34389fb2c3ef2951428bc4e46c54ac1e81aa422fddb348bec

SHA512
ca7519dcdbf07a171062b2ece686769258fefed1a413df31dfd0cf9f4520ecceb40c520cb5fe07f294b398cedc90466ffe6ec12c19e25647c0f865d4a53de9ff

Download Submit
C:\Users\Public\vbc.exe

Filesize
2.3MB

MD5
238520dfc9517e6ddeb61c218ad72ae7

SHA1
2c7e7f7b5aedc1ad2c6182e70e7a46903eace91c

SHA256
3c48e370ded1c9b34389fb2c3ef2951428bc4e46c54ac1e81aa422fddb348bec

SHA512
ca7519dcdbf07a171062b2ece686769258fefed1a413df31dfd0cf9f4520ecceb40c520cb5fe07f294b398cedc90466ffe6ec12c19e25647c0f865d4a53de9ff

Download Submit
\Users\Public\vbc.exe

Filesize
2.3MB

MD5
238520dfc9517e6ddeb61c218ad72ae7

SHA1
2c7e7f7b5aedc1ad2c6182e70e7a46903eace91c

SHA256
3c48e370ded1c9b34389fb2c3ef2951428bc4e46c54ac1e81aa422fddb348bec

SHA512
ca7519dcdbf07a171062b2ece686769258fefed1a413df31dfd0cf9f4520ecceb40c520cb5fe07f294b398cedc90466ffe6ec12c19e25647c0f865d4a53de9ff

Download Submit
memory/888-67-0x0000000071E2D000-0x0000000071E38000-memory.dmp

Filesize
44KB

Download
memory/888-65-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/888-59-0x00000000753F1000-0x00000000753F3000-memory.dmp

Filesize
8KB

Download
memory/888-57-0x0000000071E2D000-0x0000000071E38000-memory.dmp

Filesize
44KB

Download
memory/888-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/888-54-0x000000002FB41000-0x000000002FB44000-memory.dmp

Filesize
12KB

Download
memory/888-55-0x0000000070E41000-0x0000000070E43000-memory.dmp

Filesize
8KB

Download
memory/888-58-0x0000000071E2D000-0x0000000071E38000-memory.dmp

Filesize
44KB

Download
memory/1648-66-0x0000000000A90000-0x0000000000CDA000-memory.dmp

Filesize
2.3MB

Download
memory/1648-62-0x0000000000000000-mapping.dmp

Download
memory/1648-68-0x0000000004960000-0x0000000004BA0000-memory.dmp

Filesize
2.2MB

Download
memory/1816-69-0x0000000000000000-mapping.dmp

Download
memory/1816-71-0x00000000711C0000-0x000000007176B000-memory.dmp

Filesize
5.7MB

Download
memory/1816-72-0x00000000711C0000-0x000000007176B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads