Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
06-02-2023 23:44
Static task
static1
Behavioral task
behavioral1
Sample
6d4977cb739bd60eaf1bd6cea2258cf09a2aaab71a3646f8c055ba9fbc5db6f5.xlsx
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
6d4977cb739bd60eaf1bd6cea2258cf09a2aaab71a3646f8c055ba9fbc5db6f5.xlsx
Resource
win10v2004-20220901-en
General
-
Target
6d4977cb739bd60eaf1bd6cea2258cf09a2aaab71a3646f8c055ba9fbc5db6f5.xlsx
-
Size
896KB
-
MD5
eb5418b2d45b0f361fa93f01139871d0
-
SHA1
882c97f3fd9b406183e4ac01396ff41fabb2c1b3
-
SHA256
6d4977cb739bd60eaf1bd6cea2258cf09a2aaab71a3646f8c055ba9fbc5db6f5
-
SHA512
7aad6ed53af3b4f0d7f8da3dababe42cb48ca086bdc495ad5908ab74ee90e3dcc4f45a9b66d091241868aa21fa79b2578ee02ba9f46f4fc3ff53e4dedf068107
-
SSDEEP
24576:7oD1xqL1dePSHEwb2hvSiMBpVxYyUYbLQhCntqY:cD1xqLD7HNb2NMHVhUYbkhmqY
Malware Config
Extracted
formbook
u8ow
uzhDDUNgg10rOh8rkUMGYiLuNnRWl9gwMQ==
bfkA4IUaSgYi7IA=
ezX5yHeR21O3h2RCgQ==
x3E4ntHeLMGQm0kdTi6PJtjOVS6Em8UaKA==
xJuAYwcZLAfqrVazWjvkirgFxDSf
qrGugLdannLYegX5dCtFMA==
i61nMddueAYi7IA=
RoNMKNhtdDWpeiYoaB37TPiHTLo=
RFj3UHHrDtAktSZhYku36opnsaMbNA==
lx0g+6RPl4jwwNPRPuTD
MyEQ4oGk6vXrMM4V
0IVWH0rfKe1J4nn6J9XB
SYVlN3Zrnq2OaWpDiQ==
fNa0jy3P8KQK25rpmwqd0t8=
UZuSZpW+9ffX9KXzmgqd0t8=
Vxf85YCWvYNZjkcDdCtFMA==
0gG1EzLP7/DrMM4V
WExRGVAEE6YS5tJkTxMhR636+A==
6Tv7U4QdURt1KUI+gw==
ooR7RXgsXPtaEutnaQ3efjIXmfJePavzIA==
kH1+agwHHalYZx6qIgfY
ZWt1Rm0DSQlnBqPfWQAc/tcr
cLCK7t168nLRaWpDiQ==
mhlxXnj4ae2oyA==
cNfFjLnZBAbktB6qIgfY
e4+aeK07RtRvyDdIwbTJ
zV1cO+x+pG5zGpk=
Chw2HE2XGN4+Cr/5oYw2qDok
DP/jRm13vb2eiYBXkQ==
Ma9RHLrYBdejyIc/Mg2d/8xWIqM=
VTo6X4LaHCfge/wU
sWUqRFyEF4620a0t2n8=
gFcKdpXTkQzrMM4V
OhMDz+2HrUeaOs/fJBHkCKz7+g==
VO2d9iU2Thf318SIwq0EOA==
e1ku/6K39wfJUusrm0vPx4XRqHIvPpc=
P+jz1DwdYV0=
bTf6X4eNo29HFZaYHIdgOg==
4T4u2HphcHA0
tbfJk7tho2DrMM4V
mN6i/Su4QgqJXCqCRzW3mzJHyrWX
zW04ErzqFdmbu79Rig==
ZmprSnkJRcl0JKT6J9XB
MpWLW5et5BoKKk+rm3c=
Zr2aZxK7/FrlpnRYlw==
0U3tR3qhsDuRX0ebnn0=
wwHLoEjfITb8VSKpjXQ=
U0tVJVTjQAYi7IA=
UhwL8pe04L+OaWpDiQ==
aopHm8x6r2frMM4V
Lmst/p5BnbN6FIkTOM8rEdc=
GE06CTdjgx+Q6ZIV2H8=
EEj/aJNAfnLggR7q56O3833n8g==
iNu4mEHQ21YCng0d
KDEzCTXL1lu2jm76J9XB
75FOp9va+5X90pMaWzhMstYm
dC3913qn0YlNK0+rm3c=
JdWkeCE2aH5uMqzDQikE2IVmsaMbNA==
DXRpMVx9wYHolAeOVjsokL9HyrWX
OhHhPWGIz5DefU+rm3c=
50M3F7hrlnBBTDLKumo4nMY=
Fqq41ivP9XMLaTycqZUCOA==
711EHcp3p3EnLk+rm3c=
LT/fL08ENi0Gi1dYk4bzMQ==
majorcaplanetary.com
Signatures
-
Xloader payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1216-76-0x0000000000400000-0x000000000042C000-memory.dmp xloader behavioral1/memory/1216-85-0x0000000000400000-0x000000000042C000-memory.dmp xloader behavioral1/memory/1456-87-0x00000000000C0000-0x00000000000EC000-memory.dmp xloader behavioral1/memory/1456-92-0x00000000000C0000-0x00000000000EC000-memory.dmp xloader -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
NETSTAT.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run NETSTAT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\XJOLJXXXXZCL = "C:\\Program Files (x86)\\Zi4ap\\mfcrfil4z.exe" NETSTAT.EXE -
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 3 1128 EQNEDT32.EXE -
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
rllmqgz.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Control Panel\International\Geo\Nation rllmqgz.exe -
Executes dropped EXE 3 IoCs
Processes:
name.exerllmqgz.exerllmqgz.exepid process 1948 name.exe 1656 rllmqgz.exe 1216 rllmqgz.exe -
Loads dropped DLL 3 IoCs
Processes:
cmd.exename.exerllmqgz.exepid process 1092 cmd.exe 1948 name.exe 1656 rllmqgz.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
rllmqgz.exerllmqgz.exeNETSTAT.EXEdescription pid process target process PID 1656 set thread context of 1216 1656 rllmqgz.exe rllmqgz.exe PID 1216 set thread context of 1244 1216 rllmqgz.exe Explorer.EXE PID 1216 set thread context of 1244 1216 rllmqgz.exe Explorer.EXE PID 1456 set thread context of 1244 1456 NETSTAT.EXE Explorer.EXE -
Drops file in Program Files directory 1 IoCs
Processes:
NETSTAT.EXEdescription ioc process File opened for modification C:\Program Files (x86)\Zi4ap\mfcrfil4z.exe NETSTAT.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
NETSTAT.EXEpid process 1456 NETSTAT.EXE -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
EXCEL.EXENETSTAT.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key created \Registry\User\S-1-5-21-1214520366-621468234-4062160515-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 NETSTAT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND EXCEL.EXE -
Modifies registry class 64 IoCs
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 840 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
rllmqgz.exeNETSTAT.EXEpid process 1216 rllmqgz.exe 1216 rllmqgz.exe 1216 rllmqgz.exe 1456 NETSTAT.EXE 1456 NETSTAT.EXE 1456 NETSTAT.EXE 1456 NETSTAT.EXE 1456 NETSTAT.EXE 1456 NETSTAT.EXE 1456 NETSTAT.EXE 1456 NETSTAT.EXE 1456 NETSTAT.EXE 1456 NETSTAT.EXE 1456 NETSTAT.EXE 1456 NETSTAT.EXE 1456 NETSTAT.EXE 1456 NETSTAT.EXE 1456 NETSTAT.EXE 1456 NETSTAT.EXE 1456 NETSTAT.EXE 1456 NETSTAT.EXE 1456 NETSTAT.EXE 1456 NETSTAT.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1244 Explorer.EXE -
Suspicious behavior: MapViewOfSection 9 IoCs
Processes:
rllmqgz.exerllmqgz.exeNETSTAT.EXEpid process 1656 rllmqgz.exe 1216 rllmqgz.exe 1216 rllmqgz.exe 1216 rllmqgz.exe 1216 rllmqgz.exe 1456 NETSTAT.EXE 1456 NETSTAT.EXE 1456 NETSTAT.EXE 1456 NETSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
rllmqgz.exeExplorer.EXENETSTAT.EXEdescription pid process Token: SeDebugPrivilege 1216 rllmqgz.exe Token: SeShutdownPrivilege 1244 Explorer.EXE Token: SeShutdownPrivilege 1244 Explorer.EXE Token: SeShutdownPrivilege 1244 Explorer.EXE Token: SeDebugPrivilege 1456 NETSTAT.EXE Token: SeShutdownPrivilege 1244 Explorer.EXE Token: SeShutdownPrivilege 1244 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
EXCEL.EXEpid process 840 EXCEL.EXE 840 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 840 EXCEL.EXE 840 EXCEL.EXE 840 EXCEL.EXE -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
EQNEDT32.EXEcmd.exename.exerllmqgz.exeExplorer.EXENETSTAT.EXEdescription pid process target process PID 1128 wrote to memory of 1092 1128 EQNEDT32.EXE cmd.exe PID 1128 wrote to memory of 1092 1128 EQNEDT32.EXE cmd.exe PID 1128 wrote to memory of 1092 1128 EQNEDT32.EXE cmd.exe PID 1128 wrote to memory of 1092 1128 EQNEDT32.EXE cmd.exe PID 1092 wrote to memory of 1948 1092 cmd.exe name.exe PID 1092 wrote to memory of 1948 1092 cmd.exe name.exe PID 1092 wrote to memory of 1948 1092 cmd.exe name.exe PID 1092 wrote to memory of 1948 1092 cmd.exe name.exe PID 1948 wrote to memory of 1656 1948 name.exe rllmqgz.exe PID 1948 wrote to memory of 1656 1948 name.exe rllmqgz.exe PID 1948 wrote to memory of 1656 1948 name.exe rllmqgz.exe PID 1948 wrote to memory of 1656 1948 name.exe rllmqgz.exe PID 1656 wrote to memory of 1216 1656 rllmqgz.exe rllmqgz.exe PID 1656 wrote to memory of 1216 1656 rllmqgz.exe rllmqgz.exe PID 1656 wrote to memory of 1216 1656 rllmqgz.exe rllmqgz.exe PID 1656 wrote to memory of 1216 1656 rllmqgz.exe rllmqgz.exe PID 1656 wrote to memory of 1216 1656 rllmqgz.exe rllmqgz.exe PID 1244 wrote to memory of 1456 1244 Explorer.EXE NETSTAT.EXE PID 1244 wrote to memory of 1456 1244 Explorer.EXE NETSTAT.EXE PID 1244 wrote to memory of 1456 1244 Explorer.EXE NETSTAT.EXE PID 1244 wrote to memory of 1456 1244 Explorer.EXE NETSTAT.EXE PID 1456 wrote to memory of 1372 1456 NETSTAT.EXE cmd.exe PID 1456 wrote to memory of 1372 1456 NETSTAT.EXE cmd.exe PID 1456 wrote to memory of 1372 1456 NETSTAT.EXE cmd.exe PID 1456 wrote to memory of 1372 1456 NETSTAT.EXE cmd.exe PID 1456 wrote to memory of 1572 1456 NETSTAT.EXE Firefox.exe PID 1456 wrote to memory of 1572 1456 NETSTAT.EXE Firefox.exe PID 1456 wrote to memory of 1572 1456 NETSTAT.EXE Firefox.exe PID 1456 wrote to memory of 1572 1456 NETSTAT.EXE Firefox.exe PID 1456 wrote to memory of 1572 1456 NETSTAT.EXE Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\6d4977cb739bd60eaf1bd6cea2258cf09a2aaab71a3646f8c055ba9fbc5db6f5.xlsx2⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Gathers network information
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\rllmqgz.exe"3⤵
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Public\name.exe2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\name.exeC:\Users\Public\name.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rllmqgz.exe"C:\Users\Admin\AppData\Local\Temp\rllmqgz.exe" C:\Users\Admin\AppData\Local\Temp\vzwxyyicjxe.p4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rllmqgz.exe"C:\Users\Admin\AppData\Local\Temp\rllmqgz.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\cfndzs.kqxFilesize
196KB
MD51a759dc3b34740652d967dc95d6b64f1
SHA1c94b419a8bf46d2c0c817f9b1d7a25ce3e2ca9af
SHA2569fd9729e2cc456b4a491f2dd4727756382a78cef76c975f190f121529d6074be
SHA512f6ddaad1384c048e9b1961e6946763e97244c7ac684027c6d30604dd2350549ee85edf9d505f4d27d22c41f8d66a666c90f64b304af0a2350a3c6837eb66c915
-
C:\Users\Admin\AppData\Local\Temp\rllmqgz.exeFilesize
361KB
MD5f1013f87b469318022cd4e9cce420b1c
SHA13c159fe1e2e883763d8e37d2158687f836d1c8f8
SHA256c07d6080495044d498b7313d0616857efc8ca9fd0569bb93183c801b5a0e0325
SHA5120e2b4809b3b17eddea9956a73c3ea9fce7a728a1f97d7aaa43122b4172265fb123fa98e7b38abce43d2b8e7cb9653779641c78ab9aa106b0da37233cbc6c7459
-
C:\Users\Admin\AppData\Local\Temp\rllmqgz.exeFilesize
361KB
MD5f1013f87b469318022cd4e9cce420b1c
SHA13c159fe1e2e883763d8e37d2158687f836d1c8f8
SHA256c07d6080495044d498b7313d0616857efc8ca9fd0569bb93183c801b5a0e0325
SHA5120e2b4809b3b17eddea9956a73c3ea9fce7a728a1f97d7aaa43122b4172265fb123fa98e7b38abce43d2b8e7cb9653779641c78ab9aa106b0da37233cbc6c7459
-
C:\Users\Admin\AppData\Local\Temp\rllmqgz.exeFilesize
361KB
MD5f1013f87b469318022cd4e9cce420b1c
SHA13c159fe1e2e883763d8e37d2158687f836d1c8f8
SHA256c07d6080495044d498b7313d0616857efc8ca9fd0569bb93183c801b5a0e0325
SHA5120e2b4809b3b17eddea9956a73c3ea9fce7a728a1f97d7aaa43122b4172265fb123fa98e7b38abce43d2b8e7cb9653779641c78ab9aa106b0da37233cbc6c7459
-
C:\Users\Admin\AppData\Local\Temp\vzwxyyicjxe.pFilesize
5KB
MD58972f6e9c913e8a98e9b93dec651b367
SHA1a4c1fe6a5b077d8d1eac8735fd6108e154d7988b
SHA2569e57c6d27b699af5187f0b64af2ba1be7dc792212266eb7d5b2767a7a27afc66
SHA512c6bd1f88f60ad891ea29e4e3258746ef8bc2383605ec28f7d83b8d3e7dca4ed996be143e556c343907d14ad465a9002cf2a7f350b4e66864205064677c620239
-
C:\Users\Public\name.exeFilesize
355KB
MD5c71d6374ee14811b90b888115a68ee38
SHA169647456d522067f625d2a4f3f52e438632d4778
SHA256cde343d0c07a0fa310a05434efafe274503dc0a5ba64bd9fdff873301ddbb5ed
SHA5120ed2d26d2fc335a497dbb7fd9aa541a332a71f0fa85e68d47c98de2eb8c47545c966d56c7eaf13fcccd74ec04833649548c94eea89ed4bf3ff2277395a815c6a
-
C:\Users\Public\name.exeFilesize
355KB
MD5c71d6374ee14811b90b888115a68ee38
SHA169647456d522067f625d2a4f3f52e438632d4778
SHA256cde343d0c07a0fa310a05434efafe274503dc0a5ba64bd9fdff873301ddbb5ed
SHA5120ed2d26d2fc335a497dbb7fd9aa541a332a71f0fa85e68d47c98de2eb8c47545c966d56c7eaf13fcccd74ec04833649548c94eea89ed4bf3ff2277395a815c6a
-
\Users\Admin\AppData\Local\Temp\rllmqgz.exeFilesize
361KB
MD5f1013f87b469318022cd4e9cce420b1c
SHA13c159fe1e2e883763d8e37d2158687f836d1c8f8
SHA256c07d6080495044d498b7313d0616857efc8ca9fd0569bb93183c801b5a0e0325
SHA5120e2b4809b3b17eddea9956a73c3ea9fce7a728a1f97d7aaa43122b4172265fb123fa98e7b38abce43d2b8e7cb9653779641c78ab9aa106b0da37233cbc6c7459
-
\Users\Admin\AppData\Local\Temp\rllmqgz.exeFilesize
361KB
MD5f1013f87b469318022cd4e9cce420b1c
SHA13c159fe1e2e883763d8e37d2158687f836d1c8f8
SHA256c07d6080495044d498b7313d0616857efc8ca9fd0569bb93183c801b5a0e0325
SHA5120e2b4809b3b17eddea9956a73c3ea9fce7a728a1f97d7aaa43122b4172265fb123fa98e7b38abce43d2b8e7cb9653779641c78ab9aa106b0da37233cbc6c7459
-
\Users\Public\name.exeFilesize
355KB
MD5c71d6374ee14811b90b888115a68ee38
SHA169647456d522067f625d2a4f3f52e438632d4778
SHA256cde343d0c07a0fa310a05434efafe274503dc0a5ba64bd9fdff873301ddbb5ed
SHA5120ed2d26d2fc335a497dbb7fd9aa541a332a71f0fa85e68d47c98de2eb8c47545c966d56c7eaf13fcccd74ec04833649548c94eea89ed4bf3ff2277395a815c6a
-
memory/840-58-0x0000000072AED000-0x0000000072AF8000-memory.dmpFilesize
44KB
-
memory/840-95-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/840-69-0x000000006CC31000-0x000000006CC33000-memory.dmpFilesize
8KB
-
memory/840-96-0x0000000072AED000-0x0000000072AF8000-memory.dmpFilesize
44KB
-
memory/840-57-0x0000000075FF1000-0x0000000075FF3000-memory.dmpFilesize
8KB
-
memory/840-78-0x000000006D101000-0x000000006D103000-memory.dmpFilesize
8KB
-
memory/840-56-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/840-81-0x0000000072AED000-0x0000000072AF8000-memory.dmpFilesize
44KB
-
memory/840-55-0x0000000071B01000-0x0000000071B03000-memory.dmpFilesize
8KB
-
memory/840-54-0x000000002F191000-0x000000002F194000-memory.dmpFilesize
12KB
-
memory/1092-60-0x0000000000000000-mapping.dmp
-
memory/1216-76-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1216-79-0x00000000001A0000-0x00000000001B1000-memory.dmpFilesize
68KB
-
memory/1216-74-0x0000000000420000-mapping.dmp
-
memory/1216-82-0x0000000000340000-0x0000000000351000-memory.dmpFilesize
68KB
-
memory/1216-85-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1216-77-0x00000000009C0000-0x0000000000CC3000-memory.dmpFilesize
3.0MB
-
memory/1244-80-0x0000000006E60000-0x0000000006FC2000-memory.dmpFilesize
1.4MB
-
memory/1244-83-0x0000000004920000-0x0000000004A0E000-memory.dmpFilesize
952KB
-
memory/1244-93-0x0000000007480000-0x0000000007573000-memory.dmpFilesize
972KB
-
memory/1244-91-0x0000000007480000-0x0000000007573000-memory.dmpFilesize
972KB
-
memory/1372-88-0x0000000000000000-mapping.dmp
-
memory/1456-86-0x0000000000FB0000-0x0000000000FB9000-memory.dmpFilesize
36KB
-
memory/1456-89-0x0000000000C10000-0x0000000000F13000-memory.dmpFilesize
3.0MB
-
memory/1456-90-0x0000000000A80000-0x0000000000B10000-memory.dmpFilesize
576KB
-
memory/1456-87-0x00000000000C0000-0x00000000000EC000-memory.dmpFilesize
176KB
-
memory/1456-92-0x00000000000C0000-0x00000000000EC000-memory.dmpFilesize
176KB
-
memory/1456-84-0x0000000000000000-mapping.dmp
-
memory/1656-67-0x0000000000000000-mapping.dmp
-
memory/1948-63-0x0000000000000000-mapping.dmp