Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
06-12-2022 06:59
Static task
static1
Behavioral task
behavioral1
Sample
Aztexnika Ltd BAKU Order.xls
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
Aztexnika Ltd BAKU Order.xls
Resource
win10v2004-20220901-en
General
-
Target
Aztexnika Ltd BAKU Order.xls
-
Size
1.5MB
-
MD5
0096434371fec7c2352199a7c5d746d8
-
SHA1
42d939a4fb5bd3ab37b20239d181cac781b9ec60
-
SHA256
13cdbb613bb0df701013068c650cf252acfbd5034710710ab099d7c75fd41d30
-
SHA512
c684c087e78df4bc1e904f66bbd38b497e3475e41ea5a1db3ec847ffdb11b267a368810c6dc4ec8cbada53c365b30d318e6c169d7d5611b572ac9d0b2fd69029
-
SSDEEP
24576:XzxXXXXXXXXXXXXUXXXXXXXXXXXXXXXXDWmhxr5XXXXXXXXXXXXUXXXXXXXrXXX/:YG8VBQ6Q
Malware Config
Extracted
formbook
f4ca
omFHB5ajfJi1UEIEV9XcoRw=
UBjJkmQPyprdhcFF/bdCWQ==
evGKkBUj1je+otcfpw==
KgvGVeOATSt3nug0BIOm2JvOQycB
Lv6o3K0r9aSjI0lr9fg1txw=
LH1jJb/HieQpsEdqWCQTvX2PmsDVIeg=
99dte0XauJfk6Xv+uQxJFgA1gMktBA==
21FkkGB9gMniDQw2ffu6
r4lKBM/q6TZwVZfS
F+14qHeVWi56KdQ=
BgWXRsVoICMvvQ==
I+EozFl0Uy56KdQ=
xoXCgEllKEbWfjFCCLo=
qo9G1lXvvGt5GkxrLQWw
ORNlYic0PJ2ip4geEFSv
Yj+GFpvFxy0uVYx1fLI/XQ==
XL+veIKPjOTe4fjvFs+n
D2JKVAfuakXCAyoEvw==
voWJU81tH56wvt/vImbCcgVd
dVEcwFrmb8bZ4vXvFs+n
CMlcaOUF6cB+8Bnm2Kc=
NpYV3moXNE+ZQ4f9nVGCSA==
/GRkjGd1acLHyeLvImbCcgVd
R52MlF+Ag+LtFr1QKa7Zf/5a
kVD/mSO1YK75pA==
5q3IANfo/JHiDww2ffu6
4i8RFOH2ACRdhzja
VLWOSRe00XX6sNsijPzqiiWfFgf1J+g=
qnsgRFL46lWG
xo1QHOyKS9rj4fjvFs+n
mIHZlAqzS6ymmpMCU1uyZgE=
WCtjiGCFl/4JTiJ0R60=
c0vpAtZ3fY7TeLfdcnASQg==
Y87Xlic9/1+q3g/pUArVoB4=
kKOsRsf05wBOd67a
dDmgYgOZZ0aCMVwgDha4bgc=
ieXCbvcCyja+otcfpw==
Fd0XQwkTHHaBmNDvImbCcgVd
PK/M6eM8xOwqvw==
Pf0q8MdfICMvvQ==
EO8aPQwf7z2Du+XvImbCcgVd
BeUisSg/Ql6uJcg=
ay2v2pz4gomTESLosQ==
AGjX3ak2B+FyQ9ZKrQ==
Du0y0UXomyoxT4/arA8Du3FvpwE=
xhV7OrDTdonq4fjvFs+n
9+s2xTlaW66p2IAAnVkDQA==
AuS2UeN4Nsvl5vo8J67Zf/5a
B1vK2590RiUuuw==
/709BIUfMCIln8sus2u2aAM=
BMpYckjp699wVZfS
Pf2AqIscEhlpHlnV18IvVQk=
RKUTxUbz/zFroN/LLq+kIdZM
IuuiQ9pj7ZzciLVPiks4Rxc=
0KBn8XAV7NNm2xPxuA==
nv7yBtDj4UNE/ju8er1EZSanBXfyLv4=
sBgf41X1vKTwUspTsg==
5bk4+oQWD+X01tBEqQ==
c08KjxWnau8DDSsESMKNI+P5G/6/sYjU6g==
RJiyeEVj/N3rhNAW3qU=
v6O7hhQxA//+Oyq2ms9DWQ==
7MdHCYCb4OT5pg==
Je0NLgIfKIeFuyjxYD+i
68P+tIkhBdlwVZfS
inthecryptolane.com
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 3 1492 EQNEDT32.EXE -
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
vbc.exevjfiz.exevjfiz.exepid process 680 vbc.exe 1156 vjfiz.exe 1940 vjfiz.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
vjfiz.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\Geo\Nation vjfiz.exe -
Loads dropped DLL 4 IoCs
Processes:
EQNEDT32.EXEvbc.exevjfiz.exemsdt.exepid process 1492 EQNEDT32.EXE 680 vbc.exe 1156 vjfiz.exe 1808 msdt.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 4 IoCs
Processes:
vjfiz.exevjfiz.exemsdt.exedescription pid process target process PID 1156 set thread context of 1940 1156 vjfiz.exe vjfiz.exe PID 1940 set thread context of 1280 1940 vjfiz.exe Explorer.EXE PID 1940 set thread context of 1280 1940 vjfiz.exe Explorer.EXE PID 1808 set thread context of 1280 1808 msdt.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NSIS installer 6 IoCs
Processes:
resource yara_rule \Users\Public\vbc.exe nsis_installer_1 \Users\Public\vbc.exe nsis_installer_2 C:\Users\Public\vbc.exe nsis_installer_1 C:\Users\Public\vbc.exe nsis_installer_2 C:\Users\Public\vbc.exe nsis_installer_1 C:\Users\Public\vbc.exe nsis_installer_2 -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
EXCEL.EXEmsdt.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key created \Registry\User\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 msdt.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE -
Modifies registry class 64 IoCs
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1368 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
vjfiz.exemsdt.exepid process 1940 vjfiz.exe 1940 vjfiz.exe 1940 vjfiz.exe 1940 vjfiz.exe 1940 vjfiz.exe 1808 msdt.exe 1808 msdt.exe 1808 msdt.exe 1808 msdt.exe 1808 msdt.exe 1808 msdt.exe 1808 msdt.exe 1808 msdt.exe 1808 msdt.exe 1808 msdt.exe 1808 msdt.exe 1808 msdt.exe 1808 msdt.exe 1808 msdt.exe 1808 msdt.exe 1808 msdt.exe 1808 msdt.exe 1808 msdt.exe 1808 msdt.exe -
Suspicious behavior: MapViewOfSection 9 IoCs
Processes:
vjfiz.exevjfiz.exemsdt.exepid process 1156 vjfiz.exe 1940 vjfiz.exe 1940 vjfiz.exe 1940 vjfiz.exe 1940 vjfiz.exe 1808 msdt.exe 1808 msdt.exe 1808 msdt.exe 1808 msdt.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
vjfiz.exeExplorer.EXEmsdt.exedescription pid process Token: SeDebugPrivilege 1940 vjfiz.exe Token: SeShutdownPrivilege 1280 Explorer.EXE Token: SeDebugPrivilege 1808 msdt.exe Token: SeShutdownPrivilege 1280 Explorer.EXE Token: SeShutdownPrivilege 1280 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1280 Explorer.EXE 1280 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1280 Explorer.EXE 1280 Explorer.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1368 EXCEL.EXE 1368 EXCEL.EXE 1368 EXCEL.EXE -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
EQNEDT32.EXEvbc.exevjfiz.exeExplorer.EXEmsdt.exedescription pid process target process PID 1492 wrote to memory of 680 1492 EQNEDT32.EXE vbc.exe PID 1492 wrote to memory of 680 1492 EQNEDT32.EXE vbc.exe PID 1492 wrote to memory of 680 1492 EQNEDT32.EXE vbc.exe PID 1492 wrote to memory of 680 1492 EQNEDT32.EXE vbc.exe PID 680 wrote to memory of 1156 680 vbc.exe vjfiz.exe PID 680 wrote to memory of 1156 680 vbc.exe vjfiz.exe PID 680 wrote to memory of 1156 680 vbc.exe vjfiz.exe PID 680 wrote to memory of 1156 680 vbc.exe vjfiz.exe PID 1156 wrote to memory of 1940 1156 vjfiz.exe vjfiz.exe PID 1156 wrote to memory of 1940 1156 vjfiz.exe vjfiz.exe PID 1156 wrote to memory of 1940 1156 vjfiz.exe vjfiz.exe PID 1156 wrote to memory of 1940 1156 vjfiz.exe vjfiz.exe PID 1156 wrote to memory of 1940 1156 vjfiz.exe vjfiz.exe PID 1280 wrote to memory of 1808 1280 Explorer.EXE msdt.exe PID 1280 wrote to memory of 1808 1280 Explorer.EXE msdt.exe PID 1280 wrote to memory of 1808 1280 Explorer.EXE msdt.exe PID 1280 wrote to memory of 1808 1280 Explorer.EXE msdt.exe PID 1808 wrote to memory of 940 1808 msdt.exe Firefox.exe PID 1808 wrote to memory of 940 1808 msdt.exe Firefox.exe PID 1808 wrote to memory of 940 1808 msdt.exe Firefox.exe PID 1808 wrote to memory of 940 1808 msdt.exe Firefox.exe PID 1808 wrote to memory of 940 1808 msdt.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\Aztexnika Ltd BAKU Order.xls"2⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vjfiz.exe"C:\Users\Admin\AppData\Local\Temp\vjfiz.exe" C:\Users\Admin\AppData\Local\Temp\tysrzemvxjx.lq3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vjfiz.exe"C:\Users\Admin\AppData\Local\Temp\vjfiz.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\dvicdpxumc.gshFilesize
185KB
MD56bff3f9f5f10ca6c482120d288b62b08
SHA1e6e72efca642290d5daaf4c8b2fe5a759e1eadd7
SHA256499c77843bfd10fce945eab5d76cd783cd1f21aba38a1f36f854825d1f2083da
SHA512ba7dd6f593bca04792711c46f22137841efc1663aee27c8bc1fe99bc057b5475ef9240880e2a391eed5e99f59142fb49d3d35d8fc558e096127c601ece4f1d2a
-
C:\Users\Admin\AppData\Local\Temp\tysrzemvxjx.lqFilesize
5KB
MD536cf5f2a5ec6b153ee2c785c517153fa
SHA121fb70c9c27ea827abd77d7adfef003acc7b1b03
SHA25684a0d75969da88bc18370ded6588bca0d05525a24bc472c1c84bade9fc1c0479
SHA512d80a2cd1c4d0f86c64e06b728f99a8dee2239f2f0652cc88b0cd02ee28fda16309b3b7cb70b5254821fcec4b6bee640a431f08986faae8f8173b09cee3c09521
-
C:\Users\Admin\AppData\Local\Temp\vjfiz.exeFilesize
12KB
MD55d2a199396a0bd5027f1d471210eb446
SHA13237dea6926772be66227d29a9b361305734af5a
SHA256ad6a085a27238c1122dfeead4feb7085a04da98ff6805dda8a816d099e46ae97
SHA512899bc54811858e79d64b1146f37208eee74455fa976e65f83c131ed65eb71a609f32fbeccc2de21328dbbcc100f7749520464b550ce65d278254ff6446b37e73
-
C:\Users\Admin\AppData\Local\Temp\vjfiz.exeFilesize
12KB
MD55d2a199396a0bd5027f1d471210eb446
SHA13237dea6926772be66227d29a9b361305734af5a
SHA256ad6a085a27238c1122dfeead4feb7085a04da98ff6805dda8a816d099e46ae97
SHA512899bc54811858e79d64b1146f37208eee74455fa976e65f83c131ed65eb71a609f32fbeccc2de21328dbbcc100f7749520464b550ce65d278254ff6446b37e73
-
C:\Users\Admin\AppData\Local\Temp\vjfiz.exeFilesize
12KB
MD55d2a199396a0bd5027f1d471210eb446
SHA13237dea6926772be66227d29a9b361305734af5a
SHA256ad6a085a27238c1122dfeead4feb7085a04da98ff6805dda8a816d099e46ae97
SHA512899bc54811858e79d64b1146f37208eee74455fa976e65f83c131ed65eb71a609f32fbeccc2de21328dbbcc100f7749520464b550ce65d278254ff6446b37e73
-
C:\Users\Public\vbc.exeFilesize
343KB
MD50870a4727fcd6ce557f017f0fed61f51
SHA16ad1abe4d5d4f44ea753fb10df927adb1f139f2e
SHA25614afee34b6a36a32b34c61556e46fef92e6a2d9066c758308bb9caea4a94ae2a
SHA5127a97ad7ab0f0f23883ca3ee33fdf5ecca2ee3d28df3295ba3b1f1a04b71c62c7dbb7c3bc41d13ac7a84e286b41d130ef4e07a9ad79e7146e9f44baca513a03c5
-
C:\Users\Public\vbc.exeFilesize
343KB
MD50870a4727fcd6ce557f017f0fed61f51
SHA16ad1abe4d5d4f44ea753fb10df927adb1f139f2e
SHA25614afee34b6a36a32b34c61556e46fef92e6a2d9066c758308bb9caea4a94ae2a
SHA5127a97ad7ab0f0f23883ca3ee33fdf5ecca2ee3d28df3295ba3b1f1a04b71c62c7dbb7c3bc41d13ac7a84e286b41d130ef4e07a9ad79e7146e9f44baca513a03c5
-
\Users\Admin\AppData\Local\Temp\sqlite3.dllFilesize
770KB
MD565f6090dfb069aca962a59f6df9e6113
SHA1879bad504dfcce1a591c97817f3ff1e63931cfd2
SHA25632a302d8c235226d8cdda4d957f151df3e5736fdce7886e6c794f0648b2eb106
SHA5124c0e5e1103749356dceaaaa312e853bda83ec14f2f12288e9020cdf42b6e80d4caaec03d1ef7f34d81ddf2da88e6160c0c711380c2a7d89012e660406cdbb987
-
\Users\Admin\AppData\Local\Temp\vjfiz.exeFilesize
12KB
MD55d2a199396a0bd5027f1d471210eb446
SHA13237dea6926772be66227d29a9b361305734af5a
SHA256ad6a085a27238c1122dfeead4feb7085a04da98ff6805dda8a816d099e46ae97
SHA512899bc54811858e79d64b1146f37208eee74455fa976e65f83c131ed65eb71a609f32fbeccc2de21328dbbcc100f7749520464b550ce65d278254ff6446b37e73
-
\Users\Admin\AppData\Local\Temp\vjfiz.exeFilesize
12KB
MD55d2a199396a0bd5027f1d471210eb446
SHA13237dea6926772be66227d29a9b361305734af5a
SHA256ad6a085a27238c1122dfeead4feb7085a04da98ff6805dda8a816d099e46ae97
SHA512899bc54811858e79d64b1146f37208eee74455fa976e65f83c131ed65eb71a609f32fbeccc2de21328dbbcc100f7749520464b550ce65d278254ff6446b37e73
-
\Users\Public\vbc.exeFilesize
343KB
MD50870a4727fcd6ce557f017f0fed61f51
SHA16ad1abe4d5d4f44ea753fb10df927adb1f139f2e
SHA25614afee34b6a36a32b34c61556e46fef92e6a2d9066c758308bb9caea4a94ae2a
SHA5127a97ad7ab0f0f23883ca3ee33fdf5ecca2ee3d28df3295ba3b1f1a04b71c62c7dbb7c3bc41d13ac7a84e286b41d130ef4e07a9ad79e7146e9f44baca513a03c5
-
memory/680-61-0x0000000000000000-mapping.dmp
-
memory/1156-66-0x0000000000000000-mapping.dmp
-
memory/1280-81-0x0000000006C00000-0x0000000006D51000-memory.dmpFilesize
1.3MB
-
memory/1280-91-0x0000000006D60000-0x0000000006EAB000-memory.dmpFilesize
1.3MB
-
memory/1280-92-0x0000000006D60000-0x0000000006EAB000-memory.dmpFilesize
1.3MB
-
memory/1280-79-0x0000000004B70000-0x0000000004C33000-memory.dmpFilesize
780KB
-
memory/1368-74-0x0000000071E1D000-0x0000000071E28000-memory.dmpFilesize
44KB
-
memory/1368-58-0x0000000074E41000-0x0000000074E43000-memory.dmpFilesize
8KB
-
memory/1368-95-0x0000000071E1D000-0x0000000071E28000-memory.dmpFilesize
44KB
-
memory/1368-94-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1368-55-0x0000000070E31000-0x0000000070E33000-memory.dmpFilesize
8KB
-
memory/1368-56-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1368-57-0x0000000071E1D000-0x0000000071E28000-memory.dmpFilesize
44KB
-
memory/1368-54-0x000000002FEE1000-0x000000002FEE4000-memory.dmpFilesize
12KB
-
memory/1808-90-0x0000000000080000-0x00000000000AD000-memory.dmpFilesize
180KB
-
memory/1808-89-0x0000000001EF0000-0x0000000001F7F000-memory.dmpFilesize
572KB
-
memory/1808-88-0x0000000002390000-0x0000000002693000-memory.dmpFilesize
3.0MB
-
memory/1808-82-0x0000000000000000-mapping.dmp
-
memory/1808-86-0x00000000003F0000-0x00000000004E4000-memory.dmpFilesize
976KB
-
memory/1808-87-0x0000000000080000-0x00000000000AD000-memory.dmpFilesize
180KB
-
memory/1940-85-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/1940-83-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1940-80-0x00000000001A0000-0x00000000001B0000-memory.dmpFilesize
64KB
-
memory/1940-72-0x00000000004012B0-mapping.dmp
-
memory/1940-78-0x0000000000160000-0x0000000000170000-memory.dmpFilesize
64KB
-
memory/1940-77-0x0000000000A60000-0x0000000000D63000-memory.dmpFilesize
3.0MB
-
memory/1940-76-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/1940-75-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB