Analysis
-
max time kernel
150s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
08-02-2023 13:22
Behavioral task
behavioral1
Sample
Quotation.xls
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Quotation.xls
Resource
win10v2004-20221111-en
General
-
Target
Quotation.xls
-
Size
633KB
-
MD5
dac5ac774069414c354240cb0a83727a
-
SHA1
f944c7c6f17827ca975314de4929bd51bacb68c1
-
SHA256
6bc87d562d2667c71015dde859770f7ef5f0e10bc8b4c0291433ff806b4023aa
-
SHA512
e2ed859f50de228f1a9c072271698694dd5b3efe872779e8bb02b3b8a9673d7d47753d80ab4c0cbf9d6c5c4d8660f026c46957c30e7692c99a7c7d6786a76de3
-
SSDEEP
12288:QaFiKXKRVmzBZBAhAYyCFsgZuF3WB1iaf8wshOkp:lLKjmBghtFsIOWBJEw8p
Malware Config
Extracted
formbook
4.1
g2fg
snowcrash.website
pointman.us
newheartvalve.care
drandl.com
sandspringsramblers.com
programagubernamental.online
boja.us
mvrsnike.com
mentallyillmotherhood.com
facom.us
programagubernamental.store
izivente.com
roller-v.fr
amazonbioactives.com
metaverseapple.xyz
5gt-mobilevsverizon.com
gtwebsolutions.co
scottdunn.life
usdp.trade
pikmin.run
cardano-dogs.com
bf2hgfy.xyz
teslafoot.com
rubertquintana.com
wellsfargroewards.com
santel.us
couponatonline.com
theunitedhomeland.com
pmstnly.com
strlocal.com
shelleysmucker.com
youser.online
emansdesign.com
usnikeshoesbot.top
starfish.press
scotwork.us
metamorgana.com
onyxbx.net
rivas.company
firstcoastalfb.com
onpurposetraumainformedcare.com
celimot.xyz
jecunikepemej.rest
lenovolatenightit.com
unitedsterlingcompanyky.com
safety2venture.us
facebookismetanow.com
scottdunn.review
mentallyillmotherhood.com
firstincargo.com
vikavivi.com
investmenofpairs.club
nexans.cloud
farcloud.fr
ivermectinforhumans.quest
5gmalesdf.sbs
majenta.info
6vvvvvwmetam.top
metafirstclass.com
firstcoinnews.com
btcetffutures.online
funinfortmyers.com
mangoirslk.top
metaversebasicprivacy.com
blancheshelley.xyz
Signatures
-
Formbook payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1552-82-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1552-83-0x000000000041F160-mapping.dmp formbook behavioral1/memory/1552-88-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1576-97-0x0000000000090000-0x00000000000BF000-memory.dmp formbook behavioral1/memory/1576-100-0x0000000000090000-0x00000000000BF000-memory.dmp formbook -
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 3 1036 EQNEDT32.EXE -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
vbc.exevbc.exepid process 1140 vbc.exe 1552 vbc.exe -
Loads dropped DLL 5 IoCs
Processes:
EQNEDT32.EXEpid process 1036 EQNEDT32.EXE 1036 EQNEDT32.EXE 1036 EQNEDT32.EXE 1036 EQNEDT32.EXE 1036 EQNEDT32.EXE -
Uses the VBS compiler for execution 1 TTPs
-
Drops file in System32 directory 1 IoCs
Processes:
powershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
vbc.exevbc.execmstp.exedescription pid process target process PID 1140 set thread context of 1552 1140 vbc.exe vbc.exe PID 1552 set thread context of 1416 1552 vbc.exe Explorer.EXE PID 1576 set thread context of 1416 1576 cmstp.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
EXCEL.EXEdescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command EXCEL.EXE -
Modifies registry class 64 IoCs
Processes:
EXCEL.EXEdescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1500 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 17 IoCs
Processes:
powershell.exevbc.execmstp.exepid process 952 powershell.exe 1552 vbc.exe 1552 vbc.exe 1576 cmstp.exe 1576 cmstp.exe 1576 cmstp.exe 1576 cmstp.exe 1576 cmstp.exe 1576 cmstp.exe 1576 cmstp.exe 1576 cmstp.exe 1576 cmstp.exe 1576 cmstp.exe 1576 cmstp.exe 1576 cmstp.exe 1576 cmstp.exe 1576 cmstp.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
vbc.execmstp.exepid process 1552 vbc.exe 1552 vbc.exe 1552 vbc.exe 1576 cmstp.exe 1576 cmstp.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
powershell.exevbc.execmstp.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 952 powershell.exe Token: SeDebugPrivilege 1552 vbc.exe Token: SeDebugPrivilege 1576 cmstp.exe Token: SeShutdownPrivilege 1416 Explorer.EXE Token: SeShutdownPrivilege 1416 Explorer.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1500 EXCEL.EXE 1500 EXCEL.EXE 1500 EXCEL.EXE -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
EQNEDT32.EXEvbc.exeExplorer.EXEcmstp.exedescription pid process target process PID 1036 wrote to memory of 1140 1036 EQNEDT32.EXE vbc.exe PID 1036 wrote to memory of 1140 1036 EQNEDT32.EXE vbc.exe PID 1036 wrote to memory of 1140 1036 EQNEDT32.EXE vbc.exe PID 1036 wrote to memory of 1140 1036 EQNEDT32.EXE vbc.exe PID 1140 wrote to memory of 952 1140 vbc.exe powershell.exe PID 1140 wrote to memory of 952 1140 vbc.exe powershell.exe PID 1140 wrote to memory of 952 1140 vbc.exe powershell.exe PID 1140 wrote to memory of 952 1140 vbc.exe powershell.exe PID 1140 wrote to memory of 456 1140 vbc.exe schtasks.exe PID 1140 wrote to memory of 456 1140 vbc.exe schtasks.exe PID 1140 wrote to memory of 456 1140 vbc.exe schtasks.exe PID 1140 wrote to memory of 456 1140 vbc.exe schtasks.exe PID 1140 wrote to memory of 1552 1140 vbc.exe vbc.exe PID 1140 wrote to memory of 1552 1140 vbc.exe vbc.exe PID 1140 wrote to memory of 1552 1140 vbc.exe vbc.exe PID 1140 wrote to memory of 1552 1140 vbc.exe vbc.exe PID 1140 wrote to memory of 1552 1140 vbc.exe vbc.exe PID 1140 wrote to memory of 1552 1140 vbc.exe vbc.exe PID 1140 wrote to memory of 1552 1140 vbc.exe vbc.exe PID 1416 wrote to memory of 1576 1416 Explorer.EXE cmstp.exe PID 1416 wrote to memory of 1576 1416 Explorer.EXE cmstp.exe PID 1416 wrote to memory of 1576 1416 Explorer.EXE cmstp.exe PID 1416 wrote to memory of 1576 1416 Explorer.EXE cmstp.exe PID 1416 wrote to memory of 1576 1416 Explorer.EXE cmstp.exe PID 1416 wrote to memory of 1576 1416 Explorer.EXE cmstp.exe PID 1416 wrote to memory of 1576 1416 Explorer.EXE cmstp.exe PID 1576 wrote to memory of 1272 1576 cmstp.exe cmd.exe PID 1576 wrote to memory of 1272 1576 cmstp.exe cmd.exe PID 1576 wrote to memory of 1272 1576 cmstp.exe cmd.exe PID 1576 wrote to memory of 1272 1576 cmstp.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\Quotation.xls2⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Public\vbc.exe"3⤵
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\WBfGYeB.exe"3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WBfGYeB" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5EB.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp5EB.tmpFilesize
1KB
MD5d76e854ffa6f36348fc63322b4581405
SHA15a7b6e24a765da5aecab6470983127737524fbaa
SHA256d952eb37e9221f316f148f5ae9d8b74ff514e3d90f6222917357e87cd2df75aa
SHA5125bd89ccbabad977684781e062f8a2858fec8b2bbf428defebeb2b8cfad0658552328f7e73cdd57cca93a0e582a614474fae4c048652729589841caaa89707f83
-
C:\Users\Public\vbc.exeFilesize
922KB
MD53b0295343f0b34fc0ae4951c48911dd2
SHA152a2bae7cb6bc5d1fe53ec58acb2cfb86e238412
SHA25640c9387d1982d53944fa9a527152ab7103457d7fb3b37865af98fe399641cf75
SHA512a418fcd67a80060341fbe86d8ee9a924ff769809dd0970e33a3643cdd661008785e9da71cc5af7c89c9baff4aa3321064db9510c69dbf08cf1fcfeeab41b55f3
-
C:\Users\Public\vbc.exeFilesize
922KB
MD53b0295343f0b34fc0ae4951c48911dd2
SHA152a2bae7cb6bc5d1fe53ec58acb2cfb86e238412
SHA25640c9387d1982d53944fa9a527152ab7103457d7fb3b37865af98fe399641cf75
SHA512a418fcd67a80060341fbe86d8ee9a924ff769809dd0970e33a3643cdd661008785e9da71cc5af7c89c9baff4aa3321064db9510c69dbf08cf1fcfeeab41b55f3
-
C:\Users\Public\vbc.exeFilesize
922KB
MD53b0295343f0b34fc0ae4951c48911dd2
SHA152a2bae7cb6bc5d1fe53ec58acb2cfb86e238412
SHA25640c9387d1982d53944fa9a527152ab7103457d7fb3b37865af98fe399641cf75
SHA512a418fcd67a80060341fbe86d8ee9a924ff769809dd0970e33a3643cdd661008785e9da71cc5af7c89c9baff4aa3321064db9510c69dbf08cf1fcfeeab41b55f3
-
\Users\Public\vbc.exeFilesize
922KB
MD53b0295343f0b34fc0ae4951c48911dd2
SHA152a2bae7cb6bc5d1fe53ec58acb2cfb86e238412
SHA25640c9387d1982d53944fa9a527152ab7103457d7fb3b37865af98fe399641cf75
SHA512a418fcd67a80060341fbe86d8ee9a924ff769809dd0970e33a3643cdd661008785e9da71cc5af7c89c9baff4aa3321064db9510c69dbf08cf1fcfeeab41b55f3
-
\Users\Public\vbc.exeFilesize
922KB
MD53b0295343f0b34fc0ae4951c48911dd2
SHA152a2bae7cb6bc5d1fe53ec58acb2cfb86e238412
SHA25640c9387d1982d53944fa9a527152ab7103457d7fb3b37865af98fe399641cf75
SHA512a418fcd67a80060341fbe86d8ee9a924ff769809dd0970e33a3643cdd661008785e9da71cc5af7c89c9baff4aa3321064db9510c69dbf08cf1fcfeeab41b55f3
-
\Users\Public\vbc.exeFilesize
922KB
MD53b0295343f0b34fc0ae4951c48911dd2
SHA152a2bae7cb6bc5d1fe53ec58acb2cfb86e238412
SHA25640c9387d1982d53944fa9a527152ab7103457d7fb3b37865af98fe399641cf75
SHA512a418fcd67a80060341fbe86d8ee9a924ff769809dd0970e33a3643cdd661008785e9da71cc5af7c89c9baff4aa3321064db9510c69dbf08cf1fcfeeab41b55f3
-
\Users\Public\vbc.exeFilesize
922KB
MD53b0295343f0b34fc0ae4951c48911dd2
SHA152a2bae7cb6bc5d1fe53ec58acb2cfb86e238412
SHA25640c9387d1982d53944fa9a527152ab7103457d7fb3b37865af98fe399641cf75
SHA512a418fcd67a80060341fbe86d8ee9a924ff769809dd0970e33a3643cdd661008785e9da71cc5af7c89c9baff4aa3321064db9510c69dbf08cf1fcfeeab41b55f3
-
\Users\Public\vbc.exeFilesize
922KB
MD53b0295343f0b34fc0ae4951c48911dd2
SHA152a2bae7cb6bc5d1fe53ec58acb2cfb86e238412
SHA25640c9387d1982d53944fa9a527152ab7103457d7fb3b37865af98fe399641cf75
SHA512a418fcd67a80060341fbe86d8ee9a924ff769809dd0970e33a3643cdd661008785e9da71cc5af7c89c9baff4aa3321064db9510c69dbf08cf1fcfeeab41b55f3
-
memory/456-75-0x0000000000000000-mapping.dmp
-
memory/952-92-0x0000000065630000-0x0000000065BDB000-memory.dmpFilesize
5.7MB
-
memory/952-87-0x0000000065630000-0x0000000065BDB000-memory.dmpFilesize
5.7MB
-
memory/952-74-0x0000000000000000-mapping.dmp
-
memory/952-86-0x0000000004B70000-0x0000000004E42000-memory.dmpFilesize
2.8MB
-
memory/1140-78-0x0000000004C10000-0x0000000004C48000-memory.dmpFilesize
224KB
-
memory/1140-65-0x0000000000000000-mapping.dmp
-
memory/1140-69-0x0000000001140000-0x000000000122C000-memory.dmpFilesize
944KB
-
memory/1140-71-0x00000000005E0000-0x00000000005F4000-memory.dmpFilesize
80KB
-
memory/1140-72-0x00000000009F0000-0x00000000009FC000-memory.dmpFilesize
48KB
-
memory/1140-73-0x0000000005C30000-0x0000000005CC0000-memory.dmpFilesize
576KB
-
memory/1272-95-0x0000000000000000-mapping.dmp
-
memory/1416-91-0x0000000006030000-0x0000000006104000-memory.dmpFilesize
848KB
-
memory/1416-104-0x0000000006830000-0x0000000006935000-memory.dmpFilesize
1.0MB
-
memory/1416-103-0x0000000006830000-0x0000000006935000-memory.dmpFilesize
1.0MB
-
memory/1500-54-0x000000002F241000-0x000000002F244000-memory.dmpFilesize
12KB
-
memory/1500-56-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1500-55-0x0000000071181000-0x0000000071183000-memory.dmpFilesize
8KB
-
memory/1500-57-0x000000007216D000-0x0000000072178000-memory.dmpFilesize
44KB
-
memory/1500-68-0x000000007216D000-0x0000000072178000-memory.dmpFilesize
44KB
-
memory/1500-102-0x000000007216D000-0x0000000072178000-memory.dmpFilesize
44KB
-
memory/1500-101-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1500-58-0x0000000076201000-0x0000000076203000-memory.dmpFilesize
8KB
-
memory/1552-89-0x0000000000920000-0x0000000000C23000-memory.dmpFilesize
3.0MB
-
memory/1552-82-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1552-90-0x00000000002E0000-0x00000000002F4000-memory.dmpFilesize
80KB
-
memory/1552-83-0x000000000041F160-mapping.dmp
-
memory/1552-88-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1552-80-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1552-79-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1576-93-0x0000000000000000-mapping.dmp
-
memory/1576-96-0x00000000004E0000-0x00000000004F8000-memory.dmpFilesize
96KB
-
memory/1576-97-0x0000000000090000-0x00000000000BF000-memory.dmpFilesize
188KB
-
memory/1576-98-0x0000000001E70000-0x0000000002173000-memory.dmpFilesize
3.0MB
-
memory/1576-99-0x0000000002180000-0x0000000002213000-memory.dmpFilesize
588KB
-
memory/1576-100-0x0000000000090000-0x00000000000BF000-memory.dmpFilesize
188KB