Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
03-12-2022 01:12
Static task
static1
Behavioral task
behavioral1
Sample
9b81d5a774c8e6ee7bceed2661e9f58b600c75aac7027d92521201a28b7882d7.xls
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
9b81d5a774c8e6ee7bceed2661e9f58b600c75aac7027d92521201a28b7882d7.xls
Resource
win10v2004-20221111-en
General
-
Target
9b81d5a774c8e6ee7bceed2661e9f58b600c75aac7027d92521201a28b7882d7.xls
-
Size
1.1MB
-
MD5
47325c14fe5c22486ed25c43367779ba
-
SHA1
17a51494cd6492da17d15b40562ba223118c31f0
-
SHA256
9b81d5a774c8e6ee7bceed2661e9f58b600c75aac7027d92521201a28b7882d7
-
SHA512
81cda215b8e823836d9848a283ccb8429887a6558a5a915c65a2f67023f129251c850e6a2e00d50995fc8d171c353c44062b778dba7c73fd583f39b7d476b0ce
-
SSDEEP
24576:6L7yir5XXXXXXXXXXXXUXXXXXXXSXXXXXXXXXmBr5XXXXXXXXXXXXUXXXXXXXSXx:G2adxl4T
Malware Config
Extracted
formbook
codp
WLwbp9IgDF0DRbuq
oNQ7DHBzVHVMTxxxFCORk65Z5w==
eKyDm2P0S8i8tXrGSRxyN/GB+g==
DWLDupksnDvfKi7Q7PI=
JAaYbOFx1G0f4pcM36gDB3YaG796
KWQ71Z4U7+2Nv8K72OXED5M9oe8=
YJpvEHW5TU/wL02R9TiN0A==
tpQX78fPprFMi7ocSgXfUNYKpTq33Icp
a9Z0eju3FKFA/YBy+MQfG3QaG796
uQzt58fSssDUenxacQCY2g==
vijGzYPYOfi2gxZLhlbA
kZfzlQg7IGPxc29BJA==
dcQu+blQlxGyZu7qw5P4L6s=
TTIXAcXMr85yqqvxWBMqdrw=
xZb/tyGC8sOjIS7Q7PI=
KnzenvO+cXkVS3biKfRDwJ9Q5Q==
ZqZvDt9+yYxqh1Si
vZD8CtVZigY/cqnmLA==
QJy2dd/p0MO1Ji7Q7PI=
l+Hmoea3jsiAcqnmLA==
j19MVSQr/CceRbwAwBMqdrw=
vS+9sWn2gDVJYeHZaHTPCN9ywAEKVg==
blpyOo9dQZt5ZxddwQVmww==
IOs9KPQyS0gISA==
nn/ZeuJwB9m55jogOw==
M49wUTbsPAwOcqnmLA==
WqL2DMvly8XMWUkzLPvkgjf1aM5QNRk=
fd7UqRCiNTCiTs+3
vY9pE5GVeJJKMpNw0Imsk65Z5w==
PoplGWGv//+qJC7Q7PI=
d8msQUS/1UNH
g3JQ+nF3X3cfRU7V4us=
CEaYiEEOXyvzU07V4us=
lWFpIAPKKBaU90M=
TzIO/uHUaDELiHVWcQCY2g==
C23Tr3r7VMWspGfecQCY2g==
nqSKdTr0YhS+hBlLhlbA
tqY5MRsZX3MVS0YS8eY=
9MouOBNcWth14KOG9e1CFHYaG796
pKi80FPSajXvnxxLhlbA
RBb0/dHxCF8DRbuq
H2JA8ah0Bg4ScqnmLA==
Ui6WUnCpdrSBlN+xk1450g==
dXUNxi54AIl/E/W/tLmhAJM9oe8=
g8SPLINNHWVYb9gTSBMqdrw=
ld0F/BjbTxaU90M=
jmTquCeAzJmZHGHL7sydCpM9oe8=
K25MOh0tGDTYolGNUQ1yxw==
B1Ozd8XF67PJZGdHJA==
Py0TshQX8wvo4n5WcQCY2g==
G378nwBW6hJ73dDIcfo=
lebDk/+/1UNH
sO5QF9cf+lLssy7Q7PI=
mu50P/Y9kRfOLS7Q7PI=
Akgd/+60CxK1KVo=
wxp6MYyFq4coVQ==
XinIiM8UXijMrUh19sfnOvav
N7THlsfP5amkUA==
DoafUba91Bo1xbahrLegAJM9oe8=
owwVtzbvRgDKNXLAzqwrDNGFpTe33Icp
kQMRCcXUvNWa4OrZxJFt9JM9oe8=
ViF1HZskhw7WOrenND/Q2ZVRhy+33Icp
3rGLk2t/q4coVQ==
L2/L3M8P5DMaGpN/6LvKmJM9oe8=
gameikanjoker123.com
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 3 672 EQNEDT32.EXE -
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
vbc.exepid process 1640 vbc.exe -
Loads dropped DLL 2 IoCs
Processes:
EQNEDT32.EXENETSTAT.EXEpid process 672 EQNEDT32.EXE 1604 NETSTAT.EXE -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
vbc.exeRegsvcs.exeNETSTAT.EXEdescription pid process target process PID 1640 set thread context of 1760 1640 vbc.exe Regsvcs.exe PID 1760 set thread context of 1424 1760 Regsvcs.exe Explorer.EXE PID 1604 set thread context of 1424 1604 NETSTAT.EXE Explorer.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
NETSTAT.EXEpid process 1604 NETSTAT.EXE -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
EXCEL.EXENETSTAT.EXEdescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key created \Registry\User\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 NETSTAT.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE -
Modifies registry class 64 IoCs
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32 EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1492 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 25 IoCs
Processes:
Regsvcs.exeNETSTAT.EXEpid process 1760 Regsvcs.exe 1760 Regsvcs.exe 1760 Regsvcs.exe 1760 Regsvcs.exe 1604 NETSTAT.EXE 1604 NETSTAT.EXE 1604 NETSTAT.EXE 1604 NETSTAT.EXE 1604 NETSTAT.EXE 1604 NETSTAT.EXE 1604 NETSTAT.EXE 1604 NETSTAT.EXE 1604 NETSTAT.EXE 1604 NETSTAT.EXE 1604 NETSTAT.EXE 1604 NETSTAT.EXE 1604 NETSTAT.EXE 1604 NETSTAT.EXE 1604 NETSTAT.EXE 1604 NETSTAT.EXE 1604 NETSTAT.EXE 1604 NETSTAT.EXE 1604 NETSTAT.EXE 1604 NETSTAT.EXE 1604 NETSTAT.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
Regsvcs.exeNETSTAT.EXEpid process 1760 Regsvcs.exe 1760 Regsvcs.exe 1760 Regsvcs.exe 1604 NETSTAT.EXE 1604 NETSTAT.EXE 1604 NETSTAT.EXE 1604 NETSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
Regsvcs.exeExplorer.EXENETSTAT.EXEdescription pid process Token: SeDebugPrivilege 1760 Regsvcs.exe Token: SeShutdownPrivilege 1424 Explorer.EXE Token: SeDebugPrivilege 1604 NETSTAT.EXE Token: SeShutdownPrivilege 1424 Explorer.EXE Token: SeShutdownPrivilege 1424 Explorer.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1492 EXCEL.EXE 1492 EXCEL.EXE 1492 EXCEL.EXE -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
EQNEDT32.EXEvbc.exeExplorer.EXENETSTAT.EXEdescription pid process target process PID 672 wrote to memory of 1640 672 EQNEDT32.EXE vbc.exe PID 672 wrote to memory of 1640 672 EQNEDT32.EXE vbc.exe PID 672 wrote to memory of 1640 672 EQNEDT32.EXE vbc.exe PID 672 wrote to memory of 1640 672 EQNEDT32.EXE vbc.exe PID 1640 wrote to memory of 1760 1640 vbc.exe Regsvcs.exe PID 1640 wrote to memory of 1760 1640 vbc.exe Regsvcs.exe PID 1640 wrote to memory of 1760 1640 vbc.exe Regsvcs.exe PID 1640 wrote to memory of 1760 1640 vbc.exe Regsvcs.exe PID 1640 wrote to memory of 1760 1640 vbc.exe Regsvcs.exe PID 1640 wrote to memory of 1760 1640 vbc.exe Regsvcs.exe PID 1640 wrote to memory of 1760 1640 vbc.exe Regsvcs.exe PID 1640 wrote to memory of 1760 1640 vbc.exe Regsvcs.exe PID 1640 wrote to memory of 1760 1640 vbc.exe Regsvcs.exe PID 1640 wrote to memory of 1760 1640 vbc.exe Regsvcs.exe PID 1424 wrote to memory of 1604 1424 Explorer.EXE NETSTAT.EXE PID 1424 wrote to memory of 1604 1424 Explorer.EXE NETSTAT.EXE PID 1424 wrote to memory of 1604 1424 Explorer.EXE NETSTAT.EXE PID 1424 wrote to memory of 1604 1424 Explorer.EXE NETSTAT.EXE PID 1604 wrote to memory of 2020 1604 NETSTAT.EXE Firefox.exe PID 1604 wrote to memory of 2020 1604 NETSTAT.EXE Firefox.exe PID 1604 wrote to memory of 2020 1604 NETSTAT.EXE Firefox.exe PID 1604 wrote to memory of 2020 1604 NETSTAT.EXE Firefox.exe PID 1604 wrote to memory of 2020 1604 NETSTAT.EXE Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\9b81d5a774c8e6ee7bceed2661e9f58b600c75aac7027d92521201a28b7882d7.xls2⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1492 -
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Gathers network information
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:2020
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:672 -
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Regsvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Regsvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1760
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\vbc.exeFilesize
269KB
MD53a12f307e3cac1a11a986c440232a00a
SHA1be573c3fa4e03b2e371d7c2ff8fe84bc0600b566
SHA256c5b8f2bdfa8c2af8d0616d57246da8465e9d41b4c7f6484dd4234c16cc0eecf6
SHA512eb825ddda85b1a33075eefc17ab54cb9a345ff11c38457de44bc1740740b69c2f0bc1b42797017f8f3127838b7ea10e820e27fc879591f1969392fbb7a94a1b8
-
C:\Users\Public\vbc.exeFilesize
269KB
MD53a12f307e3cac1a11a986c440232a00a
SHA1be573c3fa4e03b2e371d7c2ff8fe84bc0600b566
SHA256c5b8f2bdfa8c2af8d0616d57246da8465e9d41b4c7f6484dd4234c16cc0eecf6
SHA512eb825ddda85b1a33075eefc17ab54cb9a345ff11c38457de44bc1740740b69c2f0bc1b42797017f8f3127838b7ea10e820e27fc879591f1969392fbb7a94a1b8
-
\Users\Admin\AppData\Local\Temp\sqlite3.dllFilesize
902KB
MD550338cc1fa2582fa0cad8a8fa7ceb4d2
SHA1ae697ef05b6bec38fb79ff4512ae50a303dcdbce
SHA2560815a80fa73286d8c6bf0982471c61833821d9f10a20612deaa134562e7a3cda
SHA51202a006e26b1d08cb53a4b3dab23ce6a6756a7275f8b3ef00b7412f10cff75411685a3542c5dc330dad7c9f7ff26288a2e94254d00bf53c1394e7252e000c9a61
-
\Users\Public\vbc.exeFilesize
269KB
MD53a12f307e3cac1a11a986c440232a00a
SHA1be573c3fa4e03b2e371d7c2ff8fe84bc0600b566
SHA256c5b8f2bdfa8c2af8d0616d57246da8465e9d41b4c7f6484dd4234c16cc0eecf6
SHA512eb825ddda85b1a33075eefc17ab54cb9a345ff11c38457de44bc1740740b69c2f0bc1b42797017f8f3127838b7ea10e820e27fc879591f1969392fbb7a94a1b8
-
memory/1424-79-0x0000000006A20000-0x0000000006B38000-memory.dmpFilesize
1.1MB
-
memory/1424-87-0x0000000006D70000-0x0000000006ED8000-memory.dmpFilesize
1.4MB
-
memory/1424-90-0x0000000006D70000-0x0000000006ED8000-memory.dmpFilesize
1.4MB
-
memory/1492-93-0x0000000072C8D000-0x0000000072C98000-memory.dmpFilesize
44KB
-
memory/1492-57-0x0000000072C8D000-0x0000000072C98000-memory.dmpFilesize
44KB
-
memory/1492-55-0x0000000071CA1000-0x0000000071CA3000-memory.dmpFilesize
8KB
-
memory/1492-56-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1492-76-0x0000000072C8D000-0x0000000072C98000-memory.dmpFilesize
44KB
-
memory/1492-54-0x000000002F521000-0x000000002F524000-memory.dmpFilesize
12KB
-
memory/1492-92-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1492-58-0x0000000076BA1000-0x0000000076BA3000-memory.dmpFilesize
8KB
-
memory/1604-83-0x0000000000550000-0x0000000000559000-memory.dmpFilesize
36KB
-
memory/1604-88-0x0000000000080000-0x00000000000AD000-memory.dmpFilesize
180KB
-
memory/1604-86-0x0000000000560000-0x00000000005EF000-memory.dmpFilesize
572KB
-
memory/1604-80-0x0000000000000000-mapping.dmp
-
memory/1604-85-0x0000000002070000-0x0000000002373000-memory.dmpFilesize
3.0MB
-
memory/1604-84-0x0000000000080000-0x00000000000AD000-memory.dmpFilesize
180KB
-
memory/1640-61-0x0000000000000000-mapping.dmp
-
memory/1640-66-0x00000000007A0000-0x00000000007AA000-memory.dmpFilesize
40KB
-
memory/1640-65-0x0000000000290000-0x0000000000296000-memory.dmpFilesize
24KB
-
memory/1640-64-0x00000000001B0000-0x00000000001F8000-memory.dmpFilesize
288KB
-
memory/1760-73-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1760-82-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/1760-81-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1760-78-0x0000000000100000-0x0000000000110000-memory.dmpFilesize
64KB
-
memory/1760-77-0x0000000000880000-0x0000000000B83000-memory.dmpFilesize
3.0MB
-
memory/1760-74-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/1760-71-0x00000000004012B0-mapping.dmp
-
memory/1760-70-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1760-68-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1760-67-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB