Analysis
-
max time kernel
202s -
max time network
206s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
08-12-2022 10:57
Static task
static1
Behavioral task
behavioral1
Sample
Nuevo_orden.xls
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
Nuevo_orden.xls
Resource
win10v2004-20221111-en
General
-
Target
Nuevo_orden.xls
-
Size
1.4MB
-
MD5
3ec6082c0c3d4230f50fb5492fca4ce5
-
SHA1
7785a87183386d911ef22ef01f56a124d5bbb4ed
-
SHA256
fdd33a137aa5e4b3a1b1268297372067e246a8c0d9a812fb691a2d685444308d
-
SHA512
09dca1b64c7f43f6855f530462079213ab8ae14f6eb4e70720d236c0ff7407ebd144880ad3f230f6f3c727866377fa75622baf2db476f7270e3ff8110bde516a
-
SSDEEP
24576:nzxXXXXXXXXXXXXUXXXXXXXXXXXXXXXXD+m/Vr5XXXXXXXXXXXXUXXXXXXXrXXXx:I0S/XpWUe
Malware Config
Extracted
formbook
ctap
7fuiHU5O7pBugItrXtDlRbQzVNAypQ==
Ioe4Ezkvrkk5SljtGsXC
7SdYmzWqxYzoB10eYg==
87z12VKpqmy0nXHtGsXC
frPRoZR38nhTXl/tGsXC
JybcU3xwAWn21yEPd4XnKA==
B6LTKeV3SeQZAg==
9iFOJSEVtE+I6ea4tn6M72ANGm3K
bROuHdVCVl63QIZuI2etey+ugP0=
25FDh/Be3fhaReK+BwZm9aY+og==
ipYbazKawI7oB10eYg==
Y3ONgI2GHcStmm5WhEZCsE/GlNJovg==
NMjp1U2zzpPoB10eYg==
ZZOygHxoGkBxNTz1RnI=
Hy1dkswBcyQh
94qXZbB1+8ciD4Q=
JUhyQ8Fxl+4gBA==
7wuj4eTJFutgR7+k1R8mIA==
Nj3QJ1RBulY2AMS/1R8mIA==
LjFXk8zI5vgdq8N6ropiNA==
nY89gXJDEfBVKr92
B6LYriOAfArPHHFJ6GL7ft3U
kIk7p27kZ33eB10eYg==
eA93/mraXg+2L+9MtmgTxVFItQ==
hc1xr6OdNMsCXLheEGU=
IA87HCkHromAm7R9SMmazj/qn9behvU=
Mj9foknCAtvQXt9xIk2JQh4=
W3Gh+zkYE/uwRpM=
lZEqcCOT0ZjEwMKpmirjivje
CyNbfy0ZGDBqug/N1R8mIA==
X+4HQAlw2o6vVCLr9MTK
5y5nRkks1fIkCNS+67249aY+og==
ysBJtXMhhFw8
oRVBObsWGKfcB10eYg==
ME2B0Qf9HOfXchPW1R8mIA==
YY2ziIVy94hNYder3LnK
lH2tk42AJ/Vl8Dgj0s4VW6QNGm3K
D7JHhgNmmWtOn++PTX0=
0N2KxcSUx21K0Fwma3XgJZANGm3K
NR0jmgFqj09zeeLaFV3R7UxHtQ==
9hNEpVbKBNbEL3Ba9Qtq9aY+og==
3Q3ECwbkbyxftAnI1R8mIA==
lLPuydDCft4kb1/tGsXC
2WDm19rOej+aLId3M4/uMRDToNbehvU=
na3eP/JYl+4gBA==
NgVn3Zf5DvuwRpM=
8KNWzX3pIP71kYNyL226kxA=
RWCN6JUQTzuuBF8YYw==
dbtazAEhhFw8
TodAs+DIvF8nB10eYg==
1w7DOefwp0VL3LN+
HWgRe80ul+4gBA==
6V90Vb8hol01GPG9wXxNJjD/zyLqzV1e
44Kv2dbKhVtkUNKe/PpHwV5VQOA=
5vwtBv8ETBt01NyhPowI7kUJDlDA
drvozVi17rfkqWvtGsXC
CcdTmqRx/+dKGQ==
0dMEQ3Jsi1Q7B10eYg==
CVIeZrIa8thL3LN+
3Bmb3Y/zF6zeB10eYg==
/wmj22e/8s0zBpV5wqeN0kgzFqHrEnNR
BilUKx8bGvuwRpM=
gq3aAzwoLDeX+PzIkCrjivje
Mt/80j+6RE+s1yEPd4XnKA==
anniistore.com
Extracted
xloader
3.Æ…
ctap
7fuiHU5O7pBugItrXtDlRbQzVNAypQ==
Ioe4Ezkvrkk5SljtGsXC
7SdYmzWqxYzoB10eYg==
87z12VKpqmy0nXHtGsXC
frPRoZR38nhTXl/tGsXC
JybcU3xwAWn21yEPd4XnKA==
B6LTKeV3SeQZAg==
9iFOJSEVtE+I6ea4tn6M72ANGm3K
bROuHdVCVl63QIZuI2etey+ugP0=
25FDh/Be3fhaReK+BwZm9aY+og==
ipYbazKawI7oB10eYg==
Y3ONgI2GHcStmm5WhEZCsE/GlNJovg==
NMjp1U2zzpPoB10eYg==
ZZOygHxoGkBxNTz1RnI=
Hy1dkswBcyQh
94qXZbB1+8ciD4Q=
JUhyQ8Fxl+4gBA==
7wuj4eTJFutgR7+k1R8mIA==
Nj3QJ1RBulY2AMS/1R8mIA==
LjFXk8zI5vgdq8N6ropiNA==
nY89gXJDEfBVKr92
B6LYriOAfArPHHFJ6GL7ft3U
kIk7p27kZ33eB10eYg==
eA93/mraXg+2L+9MtmgTxVFItQ==
hc1xr6OdNMsCXLheEGU=
IA87HCkHromAm7R9SMmazj/qn9behvU=
Mj9foknCAtvQXt9xIk2JQh4=
W3Gh+zkYE/uwRpM=
lZEqcCOT0ZjEwMKpmirjivje
CyNbfy0ZGDBqug/N1R8mIA==
X+4HQAlw2o6vVCLr9MTK
5y5nRkks1fIkCNS+67249aY+og==
ysBJtXMhhFw8
oRVBObsWGKfcB10eYg==
ME2B0Qf9HOfXchPW1R8mIA==
YY2ziIVy94hNYder3LnK
lH2tk42AJ/Vl8Dgj0s4VW6QNGm3K
D7JHhgNmmWtOn++PTX0=
0N2KxcSUx21K0Fwma3XgJZANGm3K
NR0jmgFqj09zeeLaFV3R7UxHtQ==
9hNEpVbKBNbEL3Ba9Qtq9aY+og==
3Q3ECwbkbyxftAnI1R8mIA==
lLPuydDCft4kb1/tGsXC
2WDm19rOej+aLId3M4/uMRDToNbehvU=
na3eP/JYl+4gBA==
NgVn3Zf5DvuwRpM=
8KNWzX3pIP71kYNyL226kxA=
RWCN6JUQTzuuBF8YYw==
dbtazAEhhFw8
TodAs+DIvF8nB10eYg==
1w7DOefwp0VL3LN+
HWgRe80ul+4gBA==
6V90Vb8hol01GPG9wXxNJjD/zyLqzV1e
44Kv2dbKhVtkUNKe/PpHwV5VQOA=
5vwtBv8ETBt01NyhPowI7kUJDlDA
drvozVi17rfkqWvtGsXC
CcdTmqRx/+dKGQ==
0dMEQ3Jsi1Q7B10eYg==
CVIeZrIa8thL3LN+
3Bmb3Y/zF6zeB10eYg==
/wmj22e/8s0zBpV5wqeN0kgzFqHrEnNR
BilUKx8bGvuwRpM=
gq3aAzwoLDeX+PzIkCrjivje
Mt/80j+6RE+s1yEPd4XnKA==
anniistore.com
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 4 1712 EQNEDT32.EXE -
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
vbc.exepxzpa.exepxzpa.exepid process 324 vbc.exe 1688 pxzpa.exe 1792 pxzpa.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
pxzpa.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Control Panel\International\Geo\Nation pxzpa.exe -
Loads dropped DLL 6 IoCs
Processes:
EQNEDT32.EXEvbc.exepxzpa.exewuapp.exepid process 1712 EQNEDT32.EXE 1712 EQNEDT32.EXE 1712 EQNEDT32.EXE 324 vbc.exe 1688 pxzpa.exe 1900 wuapp.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
pxzpa.exepxzpa.exewuapp.exedescription pid process target process PID 1688 set thread context of 1792 1688 pxzpa.exe pxzpa.exe PID 1792 set thread context of 1252 1792 pxzpa.exe Explorer.EXE PID 1900 set thread context of 1252 1900 wuapp.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NSIS installer 5 IoCs
Processes:
resource yara_rule \Users\Public\vbc.exe nsis_installer_1 \Users\Public\vbc.exe nsis_installer_1 \Users\Public\vbc.exe nsis_installer_1 C:\Users\Public\vbc.exe nsis_installer_1 C:\Users\Public\vbc.exe nsis_installer_1 -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
EXCEL.EXEwuapp.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command EXCEL.EXE Key created \Registry\User\S-1-5-21-3406023954-474543476-3319432036-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 wuapp.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE -
Modifies registry class 64 IoCs
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597} EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1340 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
pxzpa.exewuapp.exepid process 1792 pxzpa.exe 1792 pxzpa.exe 1792 pxzpa.exe 1792 pxzpa.exe 1900 wuapp.exe 1900 wuapp.exe 1900 wuapp.exe 1900 wuapp.exe 1900 wuapp.exe 1900 wuapp.exe 1900 wuapp.exe 1900 wuapp.exe 1900 wuapp.exe 1900 wuapp.exe 1900 wuapp.exe 1900 wuapp.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1252 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
pxzpa.exepxzpa.exewuapp.exepid process 1688 pxzpa.exe 1792 pxzpa.exe 1792 pxzpa.exe 1792 pxzpa.exe 1900 wuapp.exe 1900 wuapp.exe 1900 wuapp.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
pxzpa.exewuapp.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1792 pxzpa.exe Token: SeDebugPrivilege 1900 wuapp.exe Token: SeShutdownPrivilege 1252 Explorer.EXE Token: SeShutdownPrivilege 1252 Explorer.EXE -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
EXCEL.EXEpid process 1340 EXCEL.EXE 1340 EXCEL.EXE 1340 EXCEL.EXE 1340 EXCEL.EXE 1340 EXCEL.EXE -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
EQNEDT32.EXEvbc.exepxzpa.exeExplorer.EXEwuapp.exedescription pid process target process PID 1712 wrote to memory of 324 1712 EQNEDT32.EXE vbc.exe PID 1712 wrote to memory of 324 1712 EQNEDT32.EXE vbc.exe PID 1712 wrote to memory of 324 1712 EQNEDT32.EXE vbc.exe PID 1712 wrote to memory of 324 1712 EQNEDT32.EXE vbc.exe PID 324 wrote to memory of 1688 324 vbc.exe pxzpa.exe PID 324 wrote to memory of 1688 324 vbc.exe pxzpa.exe PID 324 wrote to memory of 1688 324 vbc.exe pxzpa.exe PID 324 wrote to memory of 1688 324 vbc.exe pxzpa.exe PID 1688 wrote to memory of 1792 1688 pxzpa.exe pxzpa.exe PID 1688 wrote to memory of 1792 1688 pxzpa.exe pxzpa.exe PID 1688 wrote to memory of 1792 1688 pxzpa.exe pxzpa.exe PID 1688 wrote to memory of 1792 1688 pxzpa.exe pxzpa.exe PID 1688 wrote to memory of 1792 1688 pxzpa.exe pxzpa.exe PID 1252 wrote to memory of 1900 1252 Explorer.EXE wuapp.exe PID 1252 wrote to memory of 1900 1252 Explorer.EXE wuapp.exe PID 1252 wrote to memory of 1900 1252 Explorer.EXE wuapp.exe PID 1252 wrote to memory of 1900 1252 Explorer.EXE wuapp.exe PID 1252 wrote to memory of 1900 1252 Explorer.EXE wuapp.exe PID 1252 wrote to memory of 1900 1252 Explorer.EXE wuapp.exe PID 1252 wrote to memory of 1900 1252 Explorer.EXE wuapp.exe PID 1900 wrote to memory of 2028 1900 wuapp.exe Firefox.exe PID 1900 wrote to memory of 2028 1900 wuapp.exe Firefox.exe PID 1900 wrote to memory of 2028 1900 wuapp.exe Firefox.exe PID 1900 wrote to memory of 2028 1900 wuapp.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\Nuevo_orden.xls2⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\wuapp.exe"C:\Windows\SysWOW64\wuapp.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\pxzpa.exe"C:\Users\Admin\AppData\Local\Temp\pxzpa.exe" C:\Users\Admin\AppData\Local\Temp\bvfschl.llo3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\pxzpa.exe"C:\Users\Admin\AppData\Local\Temp\pxzpa.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\bvfschl.lloFilesize
5KB
MD5234ecaa2516da7694806821607cb957f
SHA15e24bc4f64658bd2c9bbfed88ca6d39d1f84f278
SHA2564559491a1389e02acd69695203a90b6692df27d34a3095ba7f4f753562754f56
SHA5121a0fb05636f903ea3b583ec022b3d1182ee7c7a872abfc99822b633cb7bb2a305200406093430e308ecaaba28b5ed2ed84223812962863592d4d2cd399b18f8c
-
C:\Users\Admin\AppData\Local\Temp\puacwrlc.qFilesize
185KB
MD5ae560924ece971bea500b39cf812665d
SHA1db73b123c1edb1cde8925d784f1f793aacf26f6e
SHA256176f6aaf297901b7100ab3164b6229042dc858876c48c04b7efeef2e71798176
SHA51267fdbe987fa13481daccc6432034ddf4a33f1033a469adbfa347d8361a9290e5dcb183a45085486ef90d1409f991494c26902d85c1c8bf29ee98753dcbb1a8e1
-
C:\Users\Admin\AppData\Local\Temp\pxzpa.exeFilesize
281KB
MD5ca0cca1b24cac955c84585eeefab6944
SHA1517916bf6278c0584e8c50e2deeb5d75c67a413b
SHA256aa4e786e9913c83ff743a8dfce23200f1c9b10a0040bd0d6507194c373607585
SHA51228194e9239b47707438c2e1637d27506335253d5ba051b15e856a0afa1f88984f793c8c8a87b28b322efa7bae7db47d6f0a8f12091275f4cc16a1226ab4bb488
-
C:\Users\Admin\AppData\Local\Temp\pxzpa.exeFilesize
281KB
MD5ca0cca1b24cac955c84585eeefab6944
SHA1517916bf6278c0584e8c50e2deeb5d75c67a413b
SHA256aa4e786e9913c83ff743a8dfce23200f1c9b10a0040bd0d6507194c373607585
SHA51228194e9239b47707438c2e1637d27506335253d5ba051b15e856a0afa1f88984f793c8c8a87b28b322efa7bae7db47d6f0a8f12091275f4cc16a1226ab4bb488
-
C:\Users\Admin\AppData\Local\Temp\pxzpa.exeFilesize
281KB
MD5ca0cca1b24cac955c84585eeefab6944
SHA1517916bf6278c0584e8c50e2deeb5d75c67a413b
SHA256aa4e786e9913c83ff743a8dfce23200f1c9b10a0040bd0d6507194c373607585
SHA51228194e9239b47707438c2e1637d27506335253d5ba051b15e856a0afa1f88984f793c8c8a87b28b322efa7bae7db47d6f0a8f12091275f4cc16a1226ab4bb488
-
C:\Users\Public\vbc.exeFilesize
336KB
MD53b33c707e522fc9e706c62687387ddbc
SHA1d98eb37e12d6d7b03fd94933ab5f7dc445c67477
SHA2567c0561d38ad8d30935cc4750ef54f86ae0e8fedd0858278b6a202cf9589ae4d5
SHA5127591fdefeff5a11fea8726d784a62229de33378f54cd27841647c53983fca87f055e40f6743bd62d7bb0493bd11b4d3a4c19529f890d924f6872d804b19c8695
-
C:\Users\Public\vbc.exeFilesize
336KB
MD53b33c707e522fc9e706c62687387ddbc
SHA1d98eb37e12d6d7b03fd94933ab5f7dc445c67477
SHA2567c0561d38ad8d30935cc4750ef54f86ae0e8fedd0858278b6a202cf9589ae4d5
SHA5127591fdefeff5a11fea8726d784a62229de33378f54cd27841647c53983fca87f055e40f6743bd62d7bb0493bd11b4d3a4c19529f890d924f6872d804b19c8695
-
\Users\Admin\AppData\Local\Temp\pxzpa.exeFilesize
281KB
MD5ca0cca1b24cac955c84585eeefab6944
SHA1517916bf6278c0584e8c50e2deeb5d75c67a413b
SHA256aa4e786e9913c83ff743a8dfce23200f1c9b10a0040bd0d6507194c373607585
SHA51228194e9239b47707438c2e1637d27506335253d5ba051b15e856a0afa1f88984f793c8c8a87b28b322efa7bae7db47d6f0a8f12091275f4cc16a1226ab4bb488
-
\Users\Admin\AppData\Local\Temp\pxzpa.exeFilesize
281KB
MD5ca0cca1b24cac955c84585eeefab6944
SHA1517916bf6278c0584e8c50e2deeb5d75c67a413b
SHA256aa4e786e9913c83ff743a8dfce23200f1c9b10a0040bd0d6507194c373607585
SHA51228194e9239b47707438c2e1637d27506335253d5ba051b15e856a0afa1f88984f793c8c8a87b28b322efa7bae7db47d6f0a8f12091275f4cc16a1226ab4bb488
-
\Users\Admin\AppData\Local\Temp\sqlite3.dllFilesize
770KB
MD565f6090dfb069aca962a59f6df9e6113
SHA1879bad504dfcce1a591c97817f3ff1e63931cfd2
SHA25632a302d8c235226d8cdda4d957f151df3e5736fdce7886e6c794f0648b2eb106
SHA5124c0e5e1103749356dceaaaa312e853bda83ec14f2f12288e9020cdf42b6e80d4caaec03d1ef7f34d81ddf2da88e6160c0c711380c2a7d89012e660406cdbb987
-
\Users\Public\vbc.exeFilesize
336KB
MD53b33c707e522fc9e706c62687387ddbc
SHA1d98eb37e12d6d7b03fd94933ab5f7dc445c67477
SHA2567c0561d38ad8d30935cc4750ef54f86ae0e8fedd0858278b6a202cf9589ae4d5
SHA5127591fdefeff5a11fea8726d784a62229de33378f54cd27841647c53983fca87f055e40f6743bd62d7bb0493bd11b4d3a4c19529f890d924f6872d804b19c8695
-
\Users\Public\vbc.exeFilesize
336KB
MD53b33c707e522fc9e706c62687387ddbc
SHA1d98eb37e12d6d7b03fd94933ab5f7dc445c67477
SHA2567c0561d38ad8d30935cc4750ef54f86ae0e8fedd0858278b6a202cf9589ae4d5
SHA5127591fdefeff5a11fea8726d784a62229de33378f54cd27841647c53983fca87f055e40f6743bd62d7bb0493bd11b4d3a4c19529f890d924f6872d804b19c8695
-
\Users\Public\vbc.exeFilesize
336KB
MD53b33c707e522fc9e706c62687387ddbc
SHA1d98eb37e12d6d7b03fd94933ab5f7dc445c67477
SHA2567c0561d38ad8d30935cc4750ef54f86ae0e8fedd0858278b6a202cf9589ae4d5
SHA5127591fdefeff5a11fea8726d784a62229de33378f54cd27841647c53983fca87f055e40f6743bd62d7bb0493bd11b4d3a4c19529f890d924f6872d804b19c8695
-
memory/324-64-0x0000000000000000-mapping.dmp
-
memory/1252-89-0x00000000072D0000-0x0000000007456000-memory.dmpFilesize
1.5MB
-
memory/1252-92-0x00000000072D0000-0x0000000007456000-memory.dmpFilesize
1.5MB
-
memory/1252-82-0x0000000006BB0000-0x0000000006CEE000-memory.dmpFilesize
1.2MB
-
memory/1340-54-0x000000002FE51000-0x000000002FE54000-memory.dmpFilesize
12KB
-
memory/1340-59-0x00000000759C1000-0x00000000759C3000-memory.dmpFilesize
8KB
-
memory/1340-58-0x000000007205D000-0x0000000072068000-memory.dmpFilesize
44KB
-
memory/1340-57-0x000000007205D000-0x0000000072068000-memory.dmpFilesize
44KB
-
memory/1340-55-0x0000000071071000-0x0000000071073000-memory.dmpFilesize
8KB
-
memory/1340-56-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1340-91-0x000000007205D000-0x0000000072068000-memory.dmpFilesize
44KB
-
memory/1340-90-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1688-69-0x0000000000000000-mapping.dmp
-
memory/1792-81-0x00000000000C0000-0x00000000000D0000-memory.dmpFilesize
64KB
-
memory/1792-80-0x0000000000700000-0x0000000000A03000-memory.dmpFilesize
3.0MB
-
memory/1792-78-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1792-79-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/1792-76-0x00000000004012B0-mapping.dmp
-
memory/1900-84-0x0000000000BE0000-0x0000000000BEB000-memory.dmpFilesize
44KB
-
memory/1900-85-0x0000000000090000-0x00000000000BD000-memory.dmpFilesize
180KB
-
memory/1900-86-0x0000000001FF0000-0x00000000022F3000-memory.dmpFilesize
3.0MB
-
memory/1900-87-0x0000000000910000-0x000000000099F000-memory.dmpFilesize
572KB
-
memory/1900-88-0x0000000000090000-0x00000000000BD000-memory.dmpFilesize
180KB
-
memory/1900-83-0x0000000000000000-mapping.dmp