Analysis
-
max time kernel
151s -
max time network
174s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
10-12-2022 08:50
Static task
static1
Behavioral task
behavioral1
Sample
Angebot anfordernDE5538100- Musterkatalog.xls
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Angebot anfordernDE5538100- Musterkatalog.xls
Resource
win10v2004-20221111-en
General
-
Target
Angebot anfordernDE5538100- Musterkatalog.xls
-
Size
1.6MB
-
MD5
35af111bd1bc8ee2f63a3b0e377526ff
-
SHA1
34ac11f6704e033dea5ee1049d4fca5501cf8d94
-
SHA256
8e7618527c598229899d7fcae8098c6031231acbcc9574061215b3658761c0aa
-
SHA512
15d6244954b35a6ff9f885c661e35b8e551d95563461c85ce5d85b705e62b4e18ae7188360f1bb6c8c0258d8b2a92aebad30c7ac64d638bea221b7baaa43dcc6
-
SSDEEP
24576:0zxXXXXXXXXXXXXUXXXXXXXXXXXXXXXXDUmeRr5XXXXXXXXXXXXUXXXXXXXrXXXC:B5h0fuYgM
Malware Config
Extracted
formbook
dwdp
jPxWFTS1Rn/K/LD47WRRW7+Veuct8yc=
ke1Wv1l26dZZxDikX9dU3s6k8+w=
+vtNyVBkx8VMf5KCaIj8DYR5QyLJgQ==
GHXPhYzwXcKgZwqBb/kejm7rfobj
yalW64iE8+aXs70=
MD83dBR0KSF4fizgRhAM
Xti3uNm2JDWgssPgRhAM
X7gYbv5uJhpvjdI0Qg==
ydxGznbNJ3tCCLAX4arq4nweMuQ=
Ca+fvtST8OBbosPgRhAM
kG1QegD8mU/E/hLw1t0=
g9FFFjEC5C2IvR/BhbSrpw==
PCkpeg38W0aPdg1rav1DFnVASw==
vSq+xBf3qjY27H3yqepK+g+nOmOMc3m7
G7WYirSZS9EYob8=
WbEWaOVIAPlSNNc4LsfL53weMuQ=
hnyAvEY4n3rTKS4g5mHKxR0=
JN7b0uCqVrQydMl7JNw=
XTki/RASDK6BCW0q8sU=
DQMBWA9wJyOKqqGSmGHKxR0=
nJmd4HyE8g0mfqI=
6dfYKMvIhrcUa8l7JNw=
rUlBWHBUCn1c8CQA8PXzeVzrfobj
58Kt4lz9o6QF
cL0w6PZmKlfE8RoS5TDZMyH0
2Lyico9qDju7nr2X
b374NM2N3g0mfqI=
bVEtbg0KgZj533zw7n631TknAk9sHT4=
ZuNZIBhiw04fmLueUhJMOeZf+ilfHy8=
GBxm5ITLhl5XQOlF4DDZMyH0
6zulYX1WAoNl0vXmhkauyDcT8kdhBi0=
pZeodP1cQf3SyQtfUQ==
wsAZpF7WPbCJEDQt62HKxR0=
1A1vRW5BJHzzXsl7JNw=
ubG/Epl9PIb7Xtot5mHKxR0=
ExcR7v/y1XBW6wjRx722VlHrfobj
tvtepCyscmPvrsCd
QM28Ja5N8A0mfqI=
/UuzOsQY+8WgidZJSA==
pk0ZWgUKfY4STnqImJ/ZMyH0
0/4UFT1EL86yidZJSA==
mLH6x//qm+bQvFjJpKLZMyH0
yFLYqcdEtlNQ+ovii1iGrw==
CQUKN8PsFUSwtsPgRhAM
d1JHSBRgO1zvrsCd
EX/80uRL4gztasl7JNw=
VjpQXmhQEpTVRtNISg==
icUPYOYDaj6XzNmfS4jiZkwfc3aMc3m7
YbwogyCIP+zDssTgRhAM
liKeXXL3XdW2idZJSA==
DpZxgK191uNXWDttEgV8qQ==
yCQSTlcofmfvrsCd
0HdbxU5gWZTXChULh3d8uA==
wulP5XjDdoXs8AHdilE/176mQyLJgQ==
ftUzeAdbDsGQTdNB8DTZMyH0
LyYshzZrwiL1rjbYaRIb
FxUI3fDvJSiI4+zJw9Q=
tso/3IMC7yKg1ff08AVG7tGEWT+1Rdqz
2R+QH6SM7g0mfqI=
lshW53vMIIyAR+95LXaOoAb2U3WMc3m7
JGv37fpftjotxk/Fi1iGrw==
QTswdBsMz2xN4nHfi1iGrw==
ATODSoRwHZylR6dFP0+MJBU=
TWfBPutYujsoxlzNi1iGrw==
fedefarmatour.online
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 3 1304 EQNEDT32.EXE -
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
vbc.exewyziyqqllh.exewyziyqqllh.exepid process 776 vbc.exe 1692 wyziyqqllh.exe 1560 wyziyqqllh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wyziyqqllh.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\Geo\Nation wyziyqqllh.exe -
Loads dropped DLL 7 IoCs
Processes:
EQNEDT32.EXEvbc.exewyziyqqllh.exeNAPSTAT.EXEpid process 1304 EQNEDT32.EXE 1304 EQNEDT32.EXE 1304 EQNEDT32.EXE 776 vbc.exe 776 vbc.exe 1692 wyziyqqllh.exe 1912 NAPSTAT.EXE -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
wyziyqqllh.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\aecgru = "C:\\Users\\Admin\\AppData\\Roaming\\lcdobatkse\\puisxyjyut.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\wyziyqqllh.exe\" C:\\Users\\Admin\\AppData" wyziyqqllh.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
wyziyqqllh.exewyziyqqllh.exeNAPSTAT.EXEdescription pid process target process PID 1692 set thread context of 1560 1692 wyziyqqllh.exe wyziyqqllh.exe PID 1560 set thread context of 1380 1560 wyziyqqllh.exe Explorer.EXE PID 1912 set thread context of 1380 1912 NAPSTAT.EXE Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NSIS installer 5 IoCs
Processes:
resource yara_rule \Users\Public\vbc.exe nsis_installer_1 \Users\Public\vbc.exe nsis_installer_1 \Users\Public\vbc.exe nsis_installer_1 C:\Users\Public\vbc.exe nsis_installer_1 C:\Users\Public\vbc.exe nsis_installer_1 -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
EXCEL.EXENAPSTAT.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \Registry\User\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 NAPSTAT.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE -
Modifies registry class 64 IoCs
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1600 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
wyziyqqllh.exeNAPSTAT.EXEpid process 1560 wyziyqqllh.exe 1560 wyziyqqllh.exe 1560 wyziyqqllh.exe 1560 wyziyqqllh.exe 1912 NAPSTAT.EXE 1912 NAPSTAT.EXE 1912 NAPSTAT.EXE 1912 NAPSTAT.EXE 1912 NAPSTAT.EXE 1912 NAPSTAT.EXE 1912 NAPSTAT.EXE 1912 NAPSTAT.EXE 1912 NAPSTAT.EXE 1912 NAPSTAT.EXE 1912 NAPSTAT.EXE 1912 NAPSTAT.EXE 1912 NAPSTAT.EXE 1912 NAPSTAT.EXE 1912 NAPSTAT.EXE 1912 NAPSTAT.EXE 1912 NAPSTAT.EXE 1912 NAPSTAT.EXE -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
wyziyqqllh.exewyziyqqllh.exeNAPSTAT.EXEpid process 1692 wyziyqqllh.exe 1560 wyziyqqllh.exe 1560 wyziyqqllh.exe 1560 wyziyqqllh.exe 1912 NAPSTAT.EXE 1912 NAPSTAT.EXE 1912 NAPSTAT.EXE 1912 NAPSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
wyziyqqllh.exeNAPSTAT.EXEExplorer.EXEdescription pid process Token: SeDebugPrivilege 1560 wyziyqqllh.exe Token: SeDebugPrivilege 1912 NAPSTAT.EXE Token: SeShutdownPrivilege 1380 Explorer.EXE Token: SeShutdownPrivilege 1380 Explorer.EXE Token: SeShutdownPrivilege 1380 Explorer.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1600 EXCEL.EXE 1600 EXCEL.EXE 1600 EXCEL.EXE -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
EQNEDT32.EXEvbc.exewyziyqqllh.exeExplorer.EXENAPSTAT.EXEdescription pid process target process PID 1304 wrote to memory of 776 1304 EQNEDT32.EXE vbc.exe PID 1304 wrote to memory of 776 1304 EQNEDT32.EXE vbc.exe PID 1304 wrote to memory of 776 1304 EQNEDT32.EXE vbc.exe PID 1304 wrote to memory of 776 1304 EQNEDT32.EXE vbc.exe PID 776 wrote to memory of 1692 776 vbc.exe wyziyqqllh.exe PID 776 wrote to memory of 1692 776 vbc.exe wyziyqqllh.exe PID 776 wrote to memory of 1692 776 vbc.exe wyziyqqllh.exe PID 776 wrote to memory of 1692 776 vbc.exe wyziyqqllh.exe PID 1692 wrote to memory of 1560 1692 wyziyqqllh.exe wyziyqqllh.exe PID 1692 wrote to memory of 1560 1692 wyziyqqllh.exe wyziyqqllh.exe PID 1692 wrote to memory of 1560 1692 wyziyqqllh.exe wyziyqqllh.exe PID 1692 wrote to memory of 1560 1692 wyziyqqllh.exe wyziyqqllh.exe PID 1692 wrote to memory of 1560 1692 wyziyqqllh.exe wyziyqqllh.exe PID 1380 wrote to memory of 1912 1380 Explorer.EXE NAPSTAT.EXE PID 1380 wrote to memory of 1912 1380 Explorer.EXE NAPSTAT.EXE PID 1380 wrote to memory of 1912 1380 Explorer.EXE NAPSTAT.EXE PID 1380 wrote to memory of 1912 1380 Explorer.EXE NAPSTAT.EXE PID 1912 wrote to memory of 1296 1912 NAPSTAT.EXE Firefox.exe PID 1912 wrote to memory of 1296 1912 NAPSTAT.EXE Firefox.exe PID 1912 wrote to memory of 1296 1912 NAPSTAT.EXE Firefox.exe PID 1912 wrote to memory of 1296 1912 NAPSTAT.EXE Firefox.exe PID 1912 wrote to memory of 1296 1912 NAPSTAT.EXE Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\Angebot anfordernDE5538100- Musterkatalog.xls"2⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\NAPSTAT.EXE"C:\Windows\SysWOW64\NAPSTAT.EXE"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\wyziyqqllh.exe"C:\Users\Admin\AppData\Local\Temp\wyziyqqllh.exe" C:\Users\Admin\AppData\Local\Temp\qwdscgke.dnn3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\wyziyqqllh.exe"C:\Users\Admin\AppData\Local\Temp\wyziyqqllh.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\fugegefct.sFilesize
185KB
MD52375912c75db13281f3bfc9c3ddf7646
SHA19955467017fcb057d1ca868db84f4f7ebc31fd45
SHA256f9cdfa1edf4a5f85d8ddaae338fc550580ff5094eed1507c9beca4097298d861
SHA51256242ec311c00540ebee80b661fb3fcf8674635d48675b17e1de677271ab997f3ae057f009cf34654b5241b11e1a3f0d97f8f99be4e78a4b32b519a7695e5256
-
C:\Users\Admin\AppData\Local\Temp\qwdscgke.dnnFilesize
7KB
MD52c406815d04080e2fa43ba9e99ceabd3
SHA127b0f2b81e15d7715867accb5fa68f8c8f4ea209
SHA256b70fa69ab56821b4902e9922d786948c5673440e0f8dd5403385d96d0167cee4
SHA51232df91288abf935fb71e1fa04beeed0d945877f2ed2830fd7068344523371a05bc5fe973f475e8a1f9b5d95f50ca4ae9ab75a5182a063476209f2cb22b6c9b89
-
C:\Users\Admin\AppData\Local\Temp\wyziyqqllh.exeFilesize
276KB
MD5bd4eb7604f815c32830ec68cc479ad62
SHA100ac1b0b12be758027c01083ad85604305d4b1af
SHA2561b417034908720dffd6e5847b89a013f0414b46a31f2e93f91446f8efede1f64
SHA512b72e5e0e8cce7a22b6053f6daed91e91bc7c81c7a314a8340aa2903d1506b4e04e91ed2d08f343f9a616ecbf3f83cbe4763ee0876dd61e2acab141adc8d4dcd9
-
C:\Users\Admin\AppData\Local\Temp\wyziyqqllh.exeFilesize
276KB
MD5bd4eb7604f815c32830ec68cc479ad62
SHA100ac1b0b12be758027c01083ad85604305d4b1af
SHA2561b417034908720dffd6e5847b89a013f0414b46a31f2e93f91446f8efede1f64
SHA512b72e5e0e8cce7a22b6053f6daed91e91bc7c81c7a314a8340aa2903d1506b4e04e91ed2d08f343f9a616ecbf3f83cbe4763ee0876dd61e2acab141adc8d4dcd9
-
C:\Users\Admin\AppData\Local\Temp\wyziyqqllh.exeFilesize
276KB
MD5bd4eb7604f815c32830ec68cc479ad62
SHA100ac1b0b12be758027c01083ad85604305d4b1af
SHA2561b417034908720dffd6e5847b89a013f0414b46a31f2e93f91446f8efede1f64
SHA512b72e5e0e8cce7a22b6053f6daed91e91bc7c81c7a314a8340aa2903d1506b4e04e91ed2d08f343f9a616ecbf3f83cbe4763ee0876dd61e2acab141adc8d4dcd9
-
C:\Users\Public\vbc.exeFilesize
333KB
MD54c974d9519a2bfe890a2fd763224d1e7
SHA12e88feb98658d7ffee549438453aef2bc162b115
SHA2561ade1d842f0cb779839799c419832a9c05238f94a678e7cbf44fae51e2264f71
SHA512fbfccf98cf6cd86715c7990c31c1a3865ea5833f471cb198bf0bf523583e540f25b285022cecb40d97a93b230b5c89f566699f3c70382af03d13327854da5b27
-
C:\Users\Public\vbc.exeFilesize
333KB
MD54c974d9519a2bfe890a2fd763224d1e7
SHA12e88feb98658d7ffee549438453aef2bc162b115
SHA2561ade1d842f0cb779839799c419832a9c05238f94a678e7cbf44fae51e2264f71
SHA512fbfccf98cf6cd86715c7990c31c1a3865ea5833f471cb198bf0bf523583e540f25b285022cecb40d97a93b230b5c89f566699f3c70382af03d13327854da5b27
-
\Users\Admin\AppData\Local\Temp\sqlite3.dllFilesize
837KB
MD5e1b58e0aa1b377a1d0e940660ad1ace1
SHA15afc7291b26855b1252b26381ebc85ed3cca218f
SHA2561b98c006231d38524e2278a474c49274fe42e0bb1a31bcfda02e6e32f559b777
SHA5129ce778bcb586638662b090910c4ceab3b64e16dfaf905a7581c1d349fecdf186995b3cc0dc8c6fc6e9761ea2831d7b14ac1619c2bd5ebc6d18015842e5d94aa2
-
\Users\Admin\AppData\Local\Temp\wyziyqqllh.exeFilesize
276KB
MD5bd4eb7604f815c32830ec68cc479ad62
SHA100ac1b0b12be758027c01083ad85604305d4b1af
SHA2561b417034908720dffd6e5847b89a013f0414b46a31f2e93f91446f8efede1f64
SHA512b72e5e0e8cce7a22b6053f6daed91e91bc7c81c7a314a8340aa2903d1506b4e04e91ed2d08f343f9a616ecbf3f83cbe4763ee0876dd61e2acab141adc8d4dcd9
-
\Users\Admin\AppData\Local\Temp\wyziyqqllh.exeFilesize
276KB
MD5bd4eb7604f815c32830ec68cc479ad62
SHA100ac1b0b12be758027c01083ad85604305d4b1af
SHA2561b417034908720dffd6e5847b89a013f0414b46a31f2e93f91446f8efede1f64
SHA512b72e5e0e8cce7a22b6053f6daed91e91bc7c81c7a314a8340aa2903d1506b4e04e91ed2d08f343f9a616ecbf3f83cbe4763ee0876dd61e2acab141adc8d4dcd9
-
\Users\Admin\AppData\Local\Temp\wyziyqqllh.exeFilesize
276KB
MD5bd4eb7604f815c32830ec68cc479ad62
SHA100ac1b0b12be758027c01083ad85604305d4b1af
SHA2561b417034908720dffd6e5847b89a013f0414b46a31f2e93f91446f8efede1f64
SHA512b72e5e0e8cce7a22b6053f6daed91e91bc7c81c7a314a8340aa2903d1506b4e04e91ed2d08f343f9a616ecbf3f83cbe4763ee0876dd61e2acab141adc8d4dcd9
-
\Users\Public\vbc.exeFilesize
333KB
MD54c974d9519a2bfe890a2fd763224d1e7
SHA12e88feb98658d7ffee549438453aef2bc162b115
SHA2561ade1d842f0cb779839799c419832a9c05238f94a678e7cbf44fae51e2264f71
SHA512fbfccf98cf6cd86715c7990c31c1a3865ea5833f471cb198bf0bf523583e540f25b285022cecb40d97a93b230b5c89f566699f3c70382af03d13327854da5b27
-
\Users\Public\vbc.exeFilesize
333KB
MD54c974d9519a2bfe890a2fd763224d1e7
SHA12e88feb98658d7ffee549438453aef2bc162b115
SHA2561ade1d842f0cb779839799c419832a9c05238f94a678e7cbf44fae51e2264f71
SHA512fbfccf98cf6cd86715c7990c31c1a3865ea5833f471cb198bf0bf523583e540f25b285022cecb40d97a93b230b5c89f566699f3c70382af03d13327854da5b27
-
\Users\Public\vbc.exeFilesize
333KB
MD54c974d9519a2bfe890a2fd763224d1e7
SHA12e88feb98658d7ffee549438453aef2bc162b115
SHA2561ade1d842f0cb779839799c419832a9c05238f94a678e7cbf44fae51e2264f71
SHA512fbfccf98cf6cd86715c7990c31c1a3865ea5833f471cb198bf0bf523583e540f25b285022cecb40d97a93b230b5c89f566699f3c70382af03d13327854da5b27
-
memory/776-64-0x0000000000000000-mapping.dmp
-
memory/1380-83-0x0000000006B40000-0x0000000006C98000-memory.dmpFilesize
1.3MB
-
memory/1380-92-0x0000000009480000-0x000000000955C000-memory.dmpFilesize
880KB
-
memory/1380-89-0x0000000009480000-0x000000000955C000-memory.dmpFilesize
880KB
-
memory/1560-82-0x0000000000290000-0x00000000002A0000-memory.dmpFilesize
64KB
-
memory/1560-80-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1560-77-0x00000000004012B0-mapping.dmp
-
memory/1560-81-0x0000000000850000-0x0000000000B53000-memory.dmpFilesize
3.0MB
-
memory/1560-79-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1600-94-0x000000007271D000-0x0000000072728000-memory.dmpFilesize
44KB
-
memory/1600-56-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1600-58-0x00000000761F1000-0x00000000761F3000-memory.dmpFilesize
8KB
-
memory/1600-57-0x000000007271D000-0x0000000072728000-memory.dmpFilesize
44KB
-
memory/1600-60-0x000000007271D000-0x0000000072728000-memory.dmpFilesize
44KB
-
memory/1600-93-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1600-54-0x000000002F131000-0x000000002F134000-memory.dmpFilesize
12KB
-
memory/1600-55-0x0000000071731000-0x0000000071733000-memory.dmpFilesize
8KB
-
memory/1692-70-0x0000000000000000-mapping.dmp
-
memory/1912-84-0x0000000000000000-mapping.dmp
-
memory/1912-88-0x00000000008F0000-0x000000000097F000-memory.dmpFilesize
572KB
-
memory/1912-87-0x0000000002130000-0x0000000002433000-memory.dmpFilesize
3.0MB
-
memory/1912-86-0x0000000000120000-0x000000000014D000-memory.dmpFilesize
180KB
-
memory/1912-85-0x0000000000CE0000-0x0000000000D26000-memory.dmpFilesize
280KB