Analysis
-
max time kernel
152s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02-12-2022 05:28
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Exploit.MathType-Obfs.Gen.25508.5883.xls
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Exploit.MathType-Obfs.Gen.25508.5883.xls
Resource
win10v2004-20221111-en
General
-
Target
SecuriteInfo.com.Exploit.MathType-Obfs.Gen.25508.5883.xls
-
Size
250KB
-
MD5
ba0a934b6dd5af65ca9a82782d44e843
-
SHA1
5957a4921c66e0bfae31d096e2a86a9c73feb5b0
-
SHA256
0b97d2123754dc9e52e88001fc59c0343b37965172255bcc4b1d592c0df69309
-
SHA512
989872eecb46877b649e6a4b17c79a6a4feb27b140aad43ff4d9215c364a2f94ec40fba3b25e34b68b7334adb76805daf434ec6eb6c99ff44bc7928f87162005
-
SSDEEP
6144:yDZ+RwPONXoRjDhIcp0fDlavx+W26nARy0f/8v:y+/q
Malware Config
Extracted
formbook
4.1
pr28
huaxinimg.com
baorungas.com
comercializadoramultimus.com
blr-batipro.com
wantagedfas.uk
1thingplan.one
cweilin.com
lorienconsultingllc.com
jdzsjwx.com
casafacil.site
hkacgt.com
hasid.africa
92dgr97k4hr9.com
cvbiop.xyz
1wbskm.top
fantasticmobility.com
goodchoice2022.com
hafizpower.com
familiajoya.com
fundscrahelp.info
654-jp.com
locksmithexpressny.com
daniellelaurenhealth.com
65062.site
globallogisticsairline.com
livingdisabilitybenfits.com
cyprusposte.com
gladyshelps.click
letv.one
59963y.com
cre8tstudio.com
expandintofreedom.com
czechpeniche.com
windkind.net
cash4.cash
h9qblfpaog.one
growhthair.com
dmukpropertysolutions.co.uk
esd-protection.com
eqweqwewqewqewq.com
jovehome.com
dibujoart.com
fuy3.com
hthg172.com
crovv-creek.com
cannyok.online
inlook24.com
minionenterprises.net
doralfoundationssale.com
higgyspianobar.com
abundantproduction.com
agriseats.tech
diwolei.com
enwaav.tech
combienes.com
josiil.com
zweniprojects.africa
criplogistic.online
nerroir.com
blurockindustry.com
imaginaitonlibrary.com
ahavahfn.com
dougrushinglistings.com
leadsintolistings.com
alpheusmangale.com
Signatures
-
Formbook payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/876-75-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2016-84-0x0000000000090000-0x00000000000BF000-memory.dmp formbook behavioral1/memory/2016-86-0x0000000000090000-0x00000000000BF000-memory.dmp formbook -
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 3 1416 EQNEDT32.EXE -
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
vbc.exerzjxgj.exerzjxgj.exepid process 1012 vbc.exe 1040 rzjxgj.exe 876 rzjxgj.exe -
Loads dropped DLL 3 IoCs
Processes:
EQNEDT32.EXEvbc.exerzjxgj.exepid process 1416 EQNEDT32.EXE 1012 vbc.exe 1040 rzjxgj.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
rzjxgj.exerzjxgj.exerundll32.exedescription pid process target process PID 1040 set thread context of 876 1040 rzjxgj.exe rzjxgj.exe PID 876 set thread context of 1284 876 rzjxgj.exe Explorer.EXE PID 2016 set thread context of 1284 2016 rundll32.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NSIS installer 6 IoCs
Processes:
resource yara_rule \Users\Public\vbc.exe nsis_installer_1 \Users\Public\vbc.exe nsis_installer_2 C:\Users\Public\vbc.exe nsis_installer_1 C:\Users\Public\vbc.exe nsis_installer_2 C:\Users\Public\vbc.exe nsis_installer_1 C:\Users\Public\vbc.exe nsis_installer_2 -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
EXCEL.EXEdescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE -
Modifies registry class 64 IoCs
Processes:
EXCEL.EXEdescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open" EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1628 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
rzjxgj.exerundll32.exepid process 876 rzjxgj.exe 876 rzjxgj.exe 2016 rundll32.exe 2016 rundll32.exe 2016 rundll32.exe 2016 rundll32.exe 2016 rundll32.exe 2016 rundll32.exe 2016 rundll32.exe 2016 rundll32.exe 2016 rundll32.exe 2016 rundll32.exe 2016 rundll32.exe 2016 rundll32.exe 2016 rundll32.exe 2016 rundll32.exe 2016 rundll32.exe 2016 rundll32.exe 2016 rundll32.exe 2016 rundll32.exe 2016 rundll32.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
rzjxgj.exerzjxgj.exerundll32.exepid process 1040 rzjxgj.exe 876 rzjxgj.exe 876 rzjxgj.exe 876 rzjxgj.exe 2016 rundll32.exe 2016 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
rzjxgj.exerundll32.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 876 rzjxgj.exe Token: SeDebugPrivilege 2016 rundll32.exe Token: SeShutdownPrivilege 1284 Explorer.EXE Token: SeShutdownPrivilege 1284 Explorer.EXE Token: SeShutdownPrivilege 1284 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1284 Explorer.EXE 1284 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1284 Explorer.EXE 1284 Explorer.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1628 EXCEL.EXE 1628 EXCEL.EXE 1628 EXCEL.EXE -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
EQNEDT32.EXEvbc.exerzjxgj.exeExplorer.EXErundll32.exedescription pid process target process PID 1416 wrote to memory of 1012 1416 EQNEDT32.EXE vbc.exe PID 1416 wrote to memory of 1012 1416 EQNEDT32.EXE vbc.exe PID 1416 wrote to memory of 1012 1416 EQNEDT32.EXE vbc.exe PID 1416 wrote to memory of 1012 1416 EQNEDT32.EXE vbc.exe PID 1012 wrote to memory of 1040 1012 vbc.exe rzjxgj.exe PID 1012 wrote to memory of 1040 1012 vbc.exe rzjxgj.exe PID 1012 wrote to memory of 1040 1012 vbc.exe rzjxgj.exe PID 1012 wrote to memory of 1040 1012 vbc.exe rzjxgj.exe PID 1040 wrote to memory of 876 1040 rzjxgj.exe rzjxgj.exe PID 1040 wrote to memory of 876 1040 rzjxgj.exe rzjxgj.exe PID 1040 wrote to memory of 876 1040 rzjxgj.exe rzjxgj.exe PID 1040 wrote to memory of 876 1040 rzjxgj.exe rzjxgj.exe PID 1040 wrote to memory of 876 1040 rzjxgj.exe rzjxgj.exe PID 1284 wrote to memory of 2016 1284 Explorer.EXE rundll32.exe PID 1284 wrote to memory of 2016 1284 Explorer.EXE rundll32.exe PID 1284 wrote to memory of 2016 1284 Explorer.EXE rundll32.exe PID 1284 wrote to memory of 2016 1284 Explorer.EXE rundll32.exe PID 1284 wrote to memory of 2016 1284 Explorer.EXE rundll32.exe PID 1284 wrote to memory of 2016 1284 Explorer.EXE rundll32.exe PID 1284 wrote to memory of 2016 1284 Explorer.EXE rundll32.exe PID 2016 wrote to memory of 1068 2016 rundll32.exe cmd.exe PID 2016 wrote to memory of 1068 2016 rundll32.exe cmd.exe PID 2016 wrote to memory of 1068 2016 rundll32.exe cmd.exe PID 2016 wrote to memory of 1068 2016 rundll32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Exploit.MathType-Obfs.Gen.25508.5883.xls2⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1628 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\rzjxgj.exe"3⤵PID:1068
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\rzjxgj.exe"C:\Users\Admin\AppData\Local\Temp\rzjxgj.exe" C:\Users\Admin\AppData\Local\Temp\okwqyzbx.uc3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\rzjxgj.exe"C:\Users\Admin\AppData\Local\Temp\rzjxgj.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:876
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\jbenz.mFilesize
185KB
MD54b4ce519a534f3436dbbc48d123b6e83
SHA1d10796875fffdebd65a4fec5de8dda497d2fc981
SHA256552b1709acc1df6fed2544cad9f85c7f715c8c7e1e48c94c6ee6607b24a1b114
SHA512b8f38ee58c66bd4b982d26aba7ec7967cd0a96a9b58c7661ffe1835c0b9f2f4c55d1484c2a79ed67eed23cc412607bfb9f77bfc4276727d94fecf917aacd7225
-
C:\Users\Admin\AppData\Local\Temp\okwqyzbx.ucFilesize
5KB
MD5e22f33b90450537ae0e9df382a3c87d2
SHA1876eacd3ee12b0223c6c0564371f0e49ce5e5f29
SHA256b9e9dcefcabf28d10c0a5cc8225b17444567e77a52bfd5b32f8f33a314129fc8
SHA51216f3130d76b6df093022d6842e86136291bd7b28c87f8cd4ec8c903996b3823595f7df69d034f459b9cc26acff8d63c68dc002a7728bbeaf86a7892219a1ad14
-
C:\Users\Admin\AppData\Local\Temp\rzjxgj.exeFilesize
104KB
MD59d249d3a0088dd3e3b7cdc0068bcb9dc
SHA11a3e0934278243d4e7c82f69f77271426c18d23d
SHA256292de2987a1b943bbfec1025d9bb571a8c8aa59dd0662565147952f8a2d3dc06
SHA51214c48fffcca018aa32a2f98ef793b28084c1691d78aa7cd2de88f7f568a2b3340920c8eef0372bccd7167a3edd333fa78cdb37ce48b62657a5cb975c8fa7a2a8
-
C:\Users\Admin\AppData\Local\Temp\rzjxgj.exeFilesize
104KB
MD59d249d3a0088dd3e3b7cdc0068bcb9dc
SHA11a3e0934278243d4e7c82f69f77271426c18d23d
SHA256292de2987a1b943bbfec1025d9bb571a8c8aa59dd0662565147952f8a2d3dc06
SHA51214c48fffcca018aa32a2f98ef793b28084c1691d78aa7cd2de88f7f568a2b3340920c8eef0372bccd7167a3edd333fa78cdb37ce48b62657a5cb975c8fa7a2a8
-
C:\Users\Admin\AppData\Local\Temp\rzjxgj.exeFilesize
104KB
MD59d249d3a0088dd3e3b7cdc0068bcb9dc
SHA11a3e0934278243d4e7c82f69f77271426c18d23d
SHA256292de2987a1b943bbfec1025d9bb571a8c8aa59dd0662565147952f8a2d3dc06
SHA51214c48fffcca018aa32a2f98ef793b28084c1691d78aa7cd2de88f7f568a2b3340920c8eef0372bccd7167a3edd333fa78cdb37ce48b62657a5cb975c8fa7a2a8
-
C:\Users\Public\vbc.exeFilesize
257KB
MD5db34b27822c1c7d80e7e59ed743ce22c
SHA1f888efab5bfd957947b95877b4c5c73067dad197
SHA2563cfd81b824673a6ba23d472bd09d5e7610a3346cce6f23956507af5eab63c012
SHA512860a92c61d02b1429853c529234ca0885cc37065503a14918ddfd722fd3281f1179fa036315a867eb36475e93db391307255e214b78733d8fd4ce7c93ed7a066
-
C:\Users\Public\vbc.exeFilesize
257KB
MD5db34b27822c1c7d80e7e59ed743ce22c
SHA1f888efab5bfd957947b95877b4c5c73067dad197
SHA2563cfd81b824673a6ba23d472bd09d5e7610a3346cce6f23956507af5eab63c012
SHA512860a92c61d02b1429853c529234ca0885cc37065503a14918ddfd722fd3281f1179fa036315a867eb36475e93db391307255e214b78733d8fd4ce7c93ed7a066
-
\Users\Admin\AppData\Local\Temp\rzjxgj.exeFilesize
104KB
MD59d249d3a0088dd3e3b7cdc0068bcb9dc
SHA11a3e0934278243d4e7c82f69f77271426c18d23d
SHA256292de2987a1b943bbfec1025d9bb571a8c8aa59dd0662565147952f8a2d3dc06
SHA51214c48fffcca018aa32a2f98ef793b28084c1691d78aa7cd2de88f7f568a2b3340920c8eef0372bccd7167a3edd333fa78cdb37ce48b62657a5cb975c8fa7a2a8
-
\Users\Admin\AppData\Local\Temp\rzjxgj.exeFilesize
104KB
MD59d249d3a0088dd3e3b7cdc0068bcb9dc
SHA11a3e0934278243d4e7c82f69f77271426c18d23d
SHA256292de2987a1b943bbfec1025d9bb571a8c8aa59dd0662565147952f8a2d3dc06
SHA51214c48fffcca018aa32a2f98ef793b28084c1691d78aa7cd2de88f7f568a2b3340920c8eef0372bccd7167a3edd333fa78cdb37ce48b62657a5cb975c8fa7a2a8
-
\Users\Public\vbc.exeFilesize
257KB
MD5db34b27822c1c7d80e7e59ed743ce22c
SHA1f888efab5bfd957947b95877b4c5c73067dad197
SHA2563cfd81b824673a6ba23d472bd09d5e7610a3346cce6f23956507af5eab63c012
SHA512860a92c61d02b1429853c529234ca0885cc37065503a14918ddfd722fd3281f1179fa036315a867eb36475e93db391307255e214b78733d8fd4ce7c93ed7a066
-
memory/876-75-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/876-73-0x000000000041F120-mapping.dmp
-
memory/876-76-0x0000000000830000-0x0000000000B33000-memory.dmpFilesize
3.0MB
-
memory/876-77-0x00000000002C0000-0x00000000002D4000-memory.dmpFilesize
80KB
-
memory/1012-61-0x0000000000000000-mapping.dmp
-
memory/1040-66-0x0000000000000000-mapping.dmp
-
memory/1068-82-0x0000000000000000-mapping.dmp
-
memory/1284-93-0x000007FEAFB40000-0x000007FEAFB4A000-memory.dmpFilesize
40KB
-
memory/1284-92-0x000007FEF6C90000-0x000007FEF6DD3000-memory.dmpFilesize
1.3MB
-
memory/1284-91-0x0000000007390000-0x00000000074A1000-memory.dmpFilesize
1.1MB
-
memory/1284-90-0x0000000007390000-0x00000000074A1000-memory.dmpFilesize
1.1MB
-
memory/1284-78-0x0000000006D60000-0x0000000006E63000-memory.dmpFilesize
1.0MB
-
memory/1628-89-0x000000007298D000-0x0000000072998000-memory.dmpFilesize
44KB
-
memory/1628-88-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1628-58-0x000000007298D000-0x0000000072998000-memory.dmpFilesize
44KB
-
memory/1628-57-0x0000000075831000-0x0000000075833000-memory.dmpFilesize
8KB
-
memory/1628-81-0x000000007298D000-0x0000000072998000-memory.dmpFilesize
44KB
-
memory/1628-56-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1628-55-0x00000000719A1000-0x00000000719A3000-memory.dmpFilesize
8KB
-
memory/1628-54-0x000000002FC71000-0x000000002FC74000-memory.dmpFilesize
12KB
-
memory/2016-84-0x0000000000090000-0x00000000000BF000-memory.dmpFilesize
188KB
-
memory/2016-87-0x0000000000970000-0x0000000000A03000-memory.dmpFilesize
588KB
-
memory/2016-86-0x0000000000090000-0x00000000000BF000-memory.dmpFilesize
188KB
-
memory/2016-85-0x0000000002170000-0x0000000002473000-memory.dmpFilesize
3.0MB
-
memory/2016-83-0x0000000000A90000-0x0000000000A9E000-memory.dmpFilesize
56KB
-
memory/2016-79-0x0000000000000000-mapping.dmp