formbook | 8d9987b12667c1d3cfd71161c7d18fe4b152557157bed38264120baa49b184be

Analysis

max time kernel
148s
max time network
151s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-01-2023 10:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Doc_230125.xlsx
Size

644KB
MD5

be7a9bc01cfea694a22d463ec14e7e3b
SHA1

1bc1b452bb230be5d4a51484ff4f2771f3792619
SHA256

8d9987b12667c1d3cfd71161c7d18fe4b152557157bed38264120baa49b184be
SHA512

e9543b207f84a9f2cd7f3b8f2c521e7dba9bef53e2d5439993e78d1596f737415f0bf1d82e2f5d4201206c2071a1661da901fbc60d54a3c6d1ecb50da47c0a38
SSDEEP

12288:frxQKDBSm3Wn/xyqZ8/uZv7Ddv4s00jN5jLelzGpEXiqYGwTtfOjOzVcV:tDn3Wn/sqH7Ddgs00/qlYEyLTAi2

Score

10^/10

formbook xloader poub loader persistence rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Campaign

poub

Decoy

WY0eksfISzRg4O6c+opnGL6gaw==

moRjn9ExtYi8UmUo+Tya

2vME+GedoxzFnuLXesUoVj4=

EvW4JWJ1NQ8nN3tA3SM=

2mK9efMZMgN1VOs=

8d0jua5b0J6AQEW7

/2cyThOd37DSTYMASDye4Q0t/Vs=

ral+tbIh2KKAQEW7

YLY9jsPtYB/FRmMo+Tya

R1WcElWAMtFxFrVqtZT2ZpIS9xRZNho=

KFXGg/T1pCC9GjrxUPTcjw==

8mMlK5nDwjjPFTP5jMtAtQ0t/Vs=

c7am8nhhlCo=

UW91trZj6dENxuRdpxOvW1Cf

sjOMUcvq6lYJCZEfV4euFzY=

62nBgPjdmWQkmWElww==

64E8JqA1aruSUvw=

NqI1reXpcR+REye0

8+y1oOsbjgSyEhjXUPTcjw==

Rx9by8gNBwN1VOs=

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1656-76-0x0000000000400000-0x000000000042C000-memory.dmp	xloader
behavioral1/memory/1656-83-0x0000000000400000-0x000000000042C000-memory.dmp	xloader
behavioral1/memory/920-87-0x0000000000080000-0x00000000000AC000-memory.dmp	xloader
behavioral1/memory/920-90-0x0000000000080000-0x00000000000AC000-memory.dmp	xloader

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

raserver.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\YHLXCRW8HH = "C:\\Program Files (x86)\\Aer4pdx_h\\mfcjrsd1nep.exe"	raserver.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	raserver.exe

Blocklisted process makes network request 1 IoCs

Processes:

EQNEDT32.EXE

flow pid process

3 1536 EQNEDT32.EXE
Downloads MZ/PE file
Executes dropped EXE 3 IoCs

Processes:

name.exexnozsgld.exexnozsgld.exe

pid process

1168 name.exe
748 xnozsgld.exe
1656 xnozsgld.exe

flow	pid	process
3	1536	EQNEDT32.EXE

pid	process
1168	name.exe
748	xnozsgld.exe
1656	xnozsgld.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

xnozsgld.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\Geo\Nation	xnozsgld.exe

Loads dropped DLL 3 IoCs

Processes:

cmd.exename.exexnozsgld.exe

pid process

368 cmd.exe
1168 name.exe
748 xnozsgld.exe

pid	process
368	cmd.exe
1168	name.exe
748	xnozsgld.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

xnozsgld.exexnozsgld.exeraserver.exe

description	pid	process	target process
PID 748 set thread context of 1656	748	xnozsgld.exe	xnozsgld.exe
PID 1656 set thread context of 1224	1656	xnozsgld.exe	Explorer.EXE
PID 920 set thread context of 1224	920	raserver.exe	Explorer.EXE

Drops file in Program Files directory 1 IoCs

Processes:

raserver.exe

description ioc process

File opened for modification C:\Program Files (x86)\Aer4pdx_h\mfcjrsd1nep.exe raserver.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

EXCEL.EXE

description ioc process

Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
exploit

Exploitation for Client Execution
T1203

Processes:

EQNEDT32.EXE

pid process

1536 EQNEDT32.EXE

description	ioc	process
File opened for modification	C:\Program Files (x86)\Aer4pdx_h\mfcjrsd1nep.exe	raserver.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

pid	process
1536	EQNEDT32.EXE

Modifies Internet Explorer settings 1 TTPs 32 IoCs

adware spyware

Modify Registry

T1112

Processes:

EXCEL.EXEraserver.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	EXCEL.EXE
Key created	\Registry\User\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	raserver.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE

Modifies registry class 64 IoCs

Processes:

EXCEL.EXE

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]"	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\""	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

968 EXCEL.EXE

pid	process
968	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 23 IoCs

Processes:

xnozsgld.exeraserver.exe

pid	process
1656	xnozsgld.exe
1656	xnozsgld.exe
920	raserver.exe
920	raserver.exe
920	raserver.exe
920	raserver.exe
920	raserver.exe
920	raserver.exe
920	raserver.exe
920	raserver.exe
920	raserver.exe
920	raserver.exe
920	raserver.exe
920	raserver.exe
920	raserver.exe
920	raserver.exe
920	raserver.exe
920	raserver.exe
920	raserver.exe
920	raserver.exe
920	raserver.exe
920	raserver.exe
920	raserver.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1224 Explorer.EXE
Suspicious behavior: MapViewOfSection 8 IoCs

Processes:

xnozsgld.exexnozsgld.exeraserver.exe

pid process

748 xnozsgld.exe
1656 xnozsgld.exe
1656 xnozsgld.exe
1656 xnozsgld.exe
920 raserver.exe
920 raserver.exe
920 raserver.exe
920 raserver.exe

pid	process
1224	Explorer.EXE

pid	process
748	xnozsgld.exe
1656	xnozsgld.exe
1656	xnozsgld.exe
1656	xnozsgld.exe
920	raserver.exe
920	raserver.exe
920	raserver.exe
920	raserver.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

xnozsgld.exeExplorer.EXEraserver.exe

description	pid	process
Token: SeDebugPrivilege	1656	xnozsgld.exe
Token: SeShutdownPrivilege	1224	Explorer.EXE
Token: SeShutdownPrivilege	1224	Explorer.EXE
Token: SeDebugPrivilege	920	raserver.exe
Token: SeShutdownPrivilege	1224	Explorer.EXE
Token: SeShutdownPrivilege	1224	Explorer.EXE
Token: SeShutdownPrivilege	1224	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

EXCEL.EXE

pid process

968 EXCEL.EXE
968 EXCEL.EXE
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

EXCEL.EXE

pid process

968 EXCEL.EXE
968 EXCEL.EXE
968 EXCEL.EXE

pid	process
968	EXCEL.EXE
968	EXCEL.EXE

pid	process
968	EXCEL.EXE
968	EXCEL.EXE
968	EXCEL.EXE

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

EQNEDT32.EXEcmd.exename.exexnozsgld.exeExplorer.EXEraserver.exe

description	pid	process	target process
PID 1536 wrote to memory of 368	1536	EQNEDT32.EXE	cmd.exe
PID 1536 wrote to memory of 368	1536	EQNEDT32.EXE	cmd.exe
PID 1536 wrote to memory of 368	1536	EQNEDT32.EXE	cmd.exe
PID 1536 wrote to memory of 368	1536	EQNEDT32.EXE	cmd.exe
PID 368 wrote to memory of 1168	368	cmd.exe	name.exe
PID 368 wrote to memory of 1168	368	cmd.exe	name.exe
PID 368 wrote to memory of 1168	368	cmd.exe	name.exe
PID 368 wrote to memory of 1168	368	cmd.exe	name.exe
PID 1168 wrote to memory of 748	1168	name.exe	xnozsgld.exe
PID 1168 wrote to memory of 748	1168	name.exe	xnozsgld.exe
PID 1168 wrote to memory of 748	1168	name.exe	xnozsgld.exe
PID 1168 wrote to memory of 748	1168	name.exe	xnozsgld.exe
PID 748 wrote to memory of 1656	748	xnozsgld.exe	xnozsgld.exe
PID 748 wrote to memory of 1656	748	xnozsgld.exe	xnozsgld.exe
PID 748 wrote to memory of 1656	748	xnozsgld.exe	xnozsgld.exe
PID 748 wrote to memory of 1656	748	xnozsgld.exe	xnozsgld.exe
PID 748 wrote to memory of 1656	748	xnozsgld.exe	xnozsgld.exe
PID 1224 wrote to memory of 920	1224	Explorer.EXE	raserver.exe
PID 1224 wrote to memory of 920	1224	Explorer.EXE	raserver.exe
PID 1224 wrote to memory of 920	1224	Explorer.EXE	raserver.exe
PID 1224 wrote to memory of 920	1224	Explorer.EXE	raserver.exe
PID 920 wrote to memory of 1336	920	raserver.exe	cmd.exe
PID 920 wrote to memory of 1336	920	raserver.exe	cmd.exe
PID 920 wrote to memory of 1336	920	raserver.exe	cmd.exe
PID 920 wrote to memory of 1336	920	raserver.exe	cmd.exe
PID 920 wrote to memory of 780	920	raserver.exe	Firefox.exe
PID 920 wrote to memory of 780	920	raserver.exe	Firefox.exe
PID 920 wrote to memory of 780	920	raserver.exe	Firefox.exe
PID 920 wrote to memory of 780	920	raserver.exe	Firefox.exe
PID 920 wrote to memory of 780	920	raserver.exe	Firefox.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1224

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\Doc_230125.xlsx
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:968

C:\Windows\SysWOW64\raserver.exe
"C:\Windows\SysWOW64\raserver.exe"
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:920

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\xnozsgld.exe"
PID:1336

C:\Program Files\Mozilla Firefox\Firefox.exe
"C:\Program Files\Mozilla Firefox\Firefox.exe"
PID:780

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
- Blocklisted process makes network request
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:1536

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Public\name.exe
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:368

C:\Users\Public\name.exe
C:\Users\Public\name.exe
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1168

C:\Users\Admin\AppData\Local\Temp\xnozsgld.exe
"C:\Users\Admin\AppData\Local\Temp\xnozsgld.exe" C:\Users\Admin\AppData\Local\Temp\ucpha.v
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:748

C:\Users\Admin\AppData\Local\Temp\xnozsgld.exe
"C:\Users\Admin\AppData\Local\Temp\xnozsgld.exe"
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1656

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Exploitation for Client Execution

T1203

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hcmpu.cqa
Filesize
196KB

MD5
28eed71dacb4522dbf2c1aeca39e2c5d

SHA1
b5633dcf66f1657552ba992c55e7124250c23a35

SHA256
22bfb554d299b3fc4686643b0522384db2c92ebf64bd80475439b8dd9bbe7bc5

SHA512
7f08bc8237868fb6509baafd3c4a01663b0577ebec86aef9cb185bec13acb8c5787604329a85c74a2ebbc3f39933929a2f36ea21513330124bd2d66363e54cae

Download Submit
C:\Users\Admin\AppData\Local\Temp\ucpha.v
Filesize
5KB

MD5
d934356067b6133646fad1aa12371a1e

SHA1
23fe2ea62be0949a32ea6609345a8b8d27ce3757

SHA256
81f2eb3bd3c2135b0d6abdcc4f2e6427a76dac558928d4c8beb648a045010ae5

SHA512
26b50a5599353328bfc4609754ead9efd9e4084e4fdb6a9479ad56ea79aed81648de897e66c3dd1c9de1cdb6eba04855e4498f0d8d09f7804224ba27ceab91d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\xnozsgld.exe
Filesize
253KB

MD5
d8394c44bc790e1bdab00823f689c1bd

SHA1
735d8986424e2ab3440f49a7a720ecaad43d491d

SHA256
234d80febbdd23b49a2ff5db4e51aa33e82cd77ff082ac6e8f32078cdd701007

SHA512
c6dd135932d86f6a7ae2b82045e024fddad3ce7286672c134e8314d2a7a003d237b4b62141b67c7947e6ca1fffa78047e015c5e714cfb56739ef152485cd559e

Download Submit
C:\Users\Admin\AppData\Local\Temp\xnozsgld.exe
Filesize
253KB

MD5
d8394c44bc790e1bdab00823f689c1bd

SHA1
735d8986424e2ab3440f49a7a720ecaad43d491d

SHA256
234d80febbdd23b49a2ff5db4e51aa33e82cd77ff082ac6e8f32078cdd701007

SHA512
c6dd135932d86f6a7ae2b82045e024fddad3ce7286672c134e8314d2a7a003d237b4b62141b67c7947e6ca1fffa78047e015c5e714cfb56739ef152485cd559e

Download Submit
C:\Users\Admin\AppData\Local\Temp\xnozsgld.exe
Filesize
253KB

MD5
d8394c44bc790e1bdab00823f689c1bd

SHA1
735d8986424e2ab3440f49a7a720ecaad43d491d

SHA256
234d80febbdd23b49a2ff5db4e51aa33e82cd77ff082ac6e8f32078cdd701007

SHA512
c6dd135932d86f6a7ae2b82045e024fddad3ce7286672c134e8314d2a7a003d237b4b62141b67c7947e6ca1fffa78047e015c5e714cfb56739ef152485cd559e

Download Submit
C:\Users\Public\name.exe
Filesize
330KB

MD5
58a93d1d064b9e8265ea798531adb0bf

SHA1
d5e30f238fabd304d30ba2c726c71fb47765b494

SHA256
d036c4b1a4ff6265030084d453558c56f6a2d19b5a6af25943c47bc96895891c

SHA512
c5e9c0e07ea8904a45011380836ff8f0b936954729df4fb18f62414322f5815ec8ebc5803729a13b783cf87a5bd723fc821405e3579e017c7b19059e57f76bfb

Download Submit
C:\Users\Public\name.exe
Filesize
330KB

MD5
58a93d1d064b9e8265ea798531adb0bf

SHA1
d5e30f238fabd304d30ba2c726c71fb47765b494

SHA256
d036c4b1a4ff6265030084d453558c56f6a2d19b5a6af25943c47bc96895891c

SHA512
c5e9c0e07ea8904a45011380836ff8f0b936954729df4fb18f62414322f5815ec8ebc5803729a13b783cf87a5bd723fc821405e3579e017c7b19059e57f76bfb

Download Submit
\Users\Admin\AppData\Local\Temp\xnozsgld.exe
Filesize
253KB

MD5
d8394c44bc790e1bdab00823f689c1bd

SHA1
735d8986424e2ab3440f49a7a720ecaad43d491d

SHA256
234d80febbdd23b49a2ff5db4e51aa33e82cd77ff082ac6e8f32078cdd701007

SHA512
c6dd135932d86f6a7ae2b82045e024fddad3ce7286672c134e8314d2a7a003d237b4b62141b67c7947e6ca1fffa78047e015c5e714cfb56739ef152485cd559e

Download Submit
\Users\Admin\AppData\Local\Temp\xnozsgld.exe
Filesize
253KB

MD5
d8394c44bc790e1bdab00823f689c1bd

SHA1
735d8986424e2ab3440f49a7a720ecaad43d491d

SHA256
234d80febbdd23b49a2ff5db4e51aa33e82cd77ff082ac6e8f32078cdd701007

SHA512
c6dd135932d86f6a7ae2b82045e024fddad3ce7286672c134e8314d2a7a003d237b4b62141b67c7947e6ca1fffa78047e015c5e714cfb56739ef152485cd559e

Download Submit
\Users\Public\name.exe
Filesize
330KB

MD5
58a93d1d064b9e8265ea798531adb0bf

SHA1
d5e30f238fabd304d30ba2c726c71fb47765b494

SHA256
d036c4b1a4ff6265030084d453558c56f6a2d19b5a6af25943c47bc96895891c

SHA512
c5e9c0e07ea8904a45011380836ff8f0b936954729df4fb18f62414322f5815ec8ebc5803729a13b783cf87a5bd723fc821405e3579e017c7b19059e57f76bfb

Download Submit
memory/368-60-0x0000000000000000-mapping.dmp

Download
memory/748-67-0x0000000000000000-mapping.dmp

Download
memory/920-82-0x0000000000000000-mapping.dmp

Download
memory/920-86-0x00000000000F0000-0x000000000010C000-memory.dmp

Filesize
112KB

Download
memory/920-90-0x0000000000080000-0x00000000000AC000-memory.dmp

Filesize
176KB

Download
memory/920-89-0x0000000001D50000-0x0000000001DE0000-memory.dmp

Filesize
576KB

Download
memory/920-88-0x0000000001F90000-0x0000000002293000-memory.dmp

Filesize
3MB

Download
memory/920-87-0x0000000000080000-0x00000000000AC000-memory.dmp

Filesize
176KB

Download
memory/968-55-0x0000000071371000-0x0000000071373000-memory.dmp

Filesize
8KB

Download
memory/968-57-0x000000007235D000-0x0000000072368000-memory.dmp

Filesize
44KB

Download
memory/968-94-0x000000007235D000-0x0000000072368000-memory.dmp

Filesize
44KB

Download
memory/968-77-0x000000006CB11000-0x000000006CB13000-memory.dmp

Filesize
8KB

Download
memory/968-93-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/968-58-0x0000000075501000-0x0000000075503000-memory.dmp

Filesize
8KB

Download
memory/968-69-0x000000006C641000-0x000000006C643000-memory.dmp

Filesize
8KB

Download
memory/968-81-0x000000007235D000-0x0000000072368000-memory.dmp

Filesize
44KB

Download
memory/968-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/968-54-0x000000002F4B1000-0x000000002F4B4000-memory.dmp

Filesize
12KB

Download
memory/1168-63-0x0000000000000000-mapping.dmp

Download
memory/1224-80-0x0000000006B70000-0x0000000006CCD000-memory.dmp

Filesize
1MB

Download
memory/1224-91-0x0000000006CD0000-0x0000000006E18000-memory.dmp

Filesize
1MB

Download
memory/1224-92-0x0000000006CD0000-0x0000000006E18000-memory.dmp

Filesize
1MB

Download
memory/1336-85-0x0000000000000000-mapping.dmp

Download
memory/1656-74-0x000000000041FF10-mapping.dmp

Download
memory/1656-83-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1656-79-0x00000000002C0000-0x00000000002D1000-memory.dmp

Filesize
68KB

Download
memory/1656-78-0x0000000000830000-0x0000000000B33000-memory.dmp

Filesize
3MB

Download
memory/1656-76-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download