Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
16-02-2023 11:56
Static task
static1
Behavioral task
behavioral1
Sample
CONTRACT 2023.docx
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
CONTRACT 2023.docx
Resource
win10v2004-20220812-en
General
-
Target
CONTRACT 2023.docx
-
Size
10KB
-
MD5
db41e48f7d56dbc3543d29270b14f41a
-
SHA1
3561319bfedaa64e9468a8c452013e9a757fd111
-
SHA256
aa47725c6f6cc10c7fb0cf630272d34456bf7eb49922fde230dbdd352819dffc
-
SHA512
ac9a9fdf069235b07539b89b85dcfa8be4fd2d306cea4139d8bb29c75c02cd852d3532701cd9b17086eb29cc9009818a37749001b527d53891f07d4c4a7ba03a
-
SSDEEP
192:ScIMmtP5hG/b7XN+eOY/O+5+5F7Jar/YEChI35OJ:SPXRE7XtOY/7wtar/YECO5C
Malware Config
Extracted
formbook
4.1
ho62
aqawonky.com
ancachsroadsideassistance.com
artologycreatlive.com
olesinfo.africa
lovebreatheandsleep.com
friendsofdragonsprings.com
homecomingmums.wiki
hg222.bet
precision-spares.co.uk
generalhospitaleu.africa
touchstone4x4.africa
dynamator.com
dental-implants-52531.com
efefear.buzz
bentonapp.net
89luxu.com
bridgesonelm.com
acesaigon.online
instantapprovals.loans
evuniverso.com
kasoraenterprises.com
instasteamer.com
granolei.com
iamavisioniar.site
beachexplo.com
ynametro.com
littlegallery-rovinj.com
27og.com
horrorcity.online
zexo.africa
perdeumane.com
drugsaddiction.co.uk
tickleyourfancy.africa
jimyhq.top
rajputnetwork.co.uk
lacuspidehn.com
bestxdenotecyby.top
gg10siyahposet.xyz
biorigin.co.uk
jye-group.com
digito.exposed
eternalstw.com
schjetne.dev
climateviking.com
easysaldoya.xyz
1233332.xyz
centerverified.online
lezzetyemekfabrikasi.com
wzshayang.com
cloudadonis.com
zxpz6.com
alifecube.com
induscontrolpcb.site
golfingineurope.com
ducksathomephotos.com
aimeesbellaboutique.com
justrebottle.com
hachettejeunesse.pro
238142.com
casabiancapanama.com
dohenydesalination.com
1-kh.com
cdhptor.xyz
island6.work
ehirtt.com
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/964-77-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/964-84-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1056-86-0x00000000000C0000-0x00000000000EF000-memory.dmp formbook behavioral1/memory/1056-87-0x00000000000C0000-0x00000000000EF000-memory.dmp formbook -
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 7 1960 EQNEDT32.EXE -
Downloads MZ/PE file
-
Abuses OpenXML format to download file from external location 2 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Office\14.0\Common WINWORD.EXE Key opened \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Office\Common\Offline\Files\http://1332625003/O_O.DOC WINWORD.EXE -
Executes dropped EXE 3 IoCs
Processes:
vbc.exexolphqs.exexolphqs.exepid process 1144 vbc.exe 1912 xolphqs.exe 964 xolphqs.exe -
Loads dropped DLL 3 IoCs
Processes:
EQNEDT32.EXEvbc.exexolphqs.exepid process 1960 EQNEDT32.EXE 1144 vbc.exe 1912 xolphqs.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
xolphqs.exexolphqs.exedescription pid process target process PID 1912 set thread context of 964 1912 xolphqs.exe xolphqs.exe PID 964 set thread context of 1412 964 xolphqs.exe Explorer.EXE PID 964 set thread context of 1412 964 xolphqs.exe Explorer.EXE -
Drops file in Windows directory 1 IoCs
Processes:
WINWORD.EXEdescription ioc process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Office loads VBA resources, possible macro or embedded object present
-
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
WINWORD.EXEdescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE -
Modifies registry class 64 IoCs
Processes:
WINWORD.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32 WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597} WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14 WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 1640 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
xolphqs.exepid process 964 xolphqs.exe 964 xolphqs.exe 964 xolphqs.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
xolphqs.exexolphqs.exepid process 1912 xolphqs.exe 964 xolphqs.exe 964 xolphqs.exe 964 xolphqs.exe 964 xolphqs.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
xolphqs.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 964 xolphqs.exe Token: SeShutdownPrivilege 1412 Explorer.EXE Token: SeShutdownPrivilege 1412 Explorer.EXE Token: SeShutdownPrivilege 1412 Explorer.EXE -
Suspicious use of FindShellTrayWindow 14 IoCs
Processes:
Explorer.EXEpid process 1412 Explorer.EXE 1412 Explorer.EXE 1412 Explorer.EXE 1412 Explorer.EXE 1412 Explorer.EXE 1412 Explorer.EXE 1412 Explorer.EXE 1412 Explorer.EXE 1412 Explorer.EXE 1412 Explorer.EXE 1412 Explorer.EXE 1412 Explorer.EXE 1412 Explorer.EXE 1412 Explorer.EXE -
Suspicious use of SendNotifyMessage 6 IoCs
Processes:
Explorer.EXEpid process 1412 Explorer.EXE 1412 Explorer.EXE 1412 Explorer.EXE 1412 Explorer.EXE 1412 Explorer.EXE 1412 Explorer.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
WINWORD.EXEpid process 1640 WINWORD.EXE 1640 WINWORD.EXE -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
EQNEDT32.EXEvbc.exeWINWORD.EXExolphqs.exexolphqs.exedescription pid process target process PID 1960 wrote to memory of 1144 1960 EQNEDT32.EXE vbc.exe PID 1960 wrote to memory of 1144 1960 EQNEDT32.EXE vbc.exe PID 1960 wrote to memory of 1144 1960 EQNEDT32.EXE vbc.exe PID 1960 wrote to memory of 1144 1960 EQNEDT32.EXE vbc.exe PID 1144 wrote to memory of 1912 1144 vbc.exe xolphqs.exe PID 1144 wrote to memory of 1912 1144 vbc.exe xolphqs.exe PID 1144 wrote to memory of 1912 1144 vbc.exe xolphqs.exe PID 1144 wrote to memory of 1912 1144 vbc.exe xolphqs.exe PID 1640 wrote to memory of 748 1640 WINWORD.EXE splwow64.exe PID 1640 wrote to memory of 748 1640 WINWORD.EXE splwow64.exe PID 1640 wrote to memory of 748 1640 WINWORD.EXE splwow64.exe PID 1640 wrote to memory of 748 1640 WINWORD.EXE splwow64.exe PID 1912 wrote to memory of 964 1912 xolphqs.exe xolphqs.exe PID 1912 wrote to memory of 964 1912 xolphqs.exe xolphqs.exe PID 1912 wrote to memory of 964 1912 xolphqs.exe xolphqs.exe PID 1912 wrote to memory of 964 1912 xolphqs.exe xolphqs.exe PID 1912 wrote to memory of 964 1912 xolphqs.exe xolphqs.exe PID 964 wrote to memory of 1056 964 xolphqs.exe help.exe PID 964 wrote to memory of 1056 964 xolphqs.exe help.exe PID 964 wrote to memory of 1056 964 xolphqs.exe help.exe PID 964 wrote to memory of 1056 964 xolphqs.exe help.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\CONTRACT 2023.docx"2⤵
- Abuses OpenXML format to download file from external location
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\xolphqs.exe"C:\Users\Admin\AppData\Local\Temp\xolphqs.exe" C:\Users\Admin\AppData\Local\Temp\mcgvde.ntc3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\xolphqs.exe"C:\Users\Admin\AppData\Local\Temp\xolphqs.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\xolphqs.exe"6⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\mcgvde.ntcFilesize
5KB
MD52158b6f6fbc4323784502fe09f67d374
SHA111d4f117b0b12624732233c4e441992c5f2aa941
SHA256852ab06f6277dad42bdb21f2286758827a85753bd448cbbf274ab5cc36769011
SHA5125087964836e512e1a96d7a5a91a332afdd4506eca891aa11bfebf0d53be18df8f7714f8956ad421337ae285042c230592553c3468118399b0067f3720c74beb5
-
C:\Users\Admin\AppData\Local\Temp\wcywthqp.loxFilesize
205KB
MD550b87517af8f71318c61195fe1b59d8d
SHA13acca8c7303a089f923736d9a23163e0c3d1bd91
SHA25683f687edce0472f433ceea84e915748bc68ea5a6262a9e8f647f152d5303d8c1
SHA512d204250af58ecc4a0f9c83a7e7d27236ab84c19eeae4836c5f5a27199cd93e70a313cf42cdafef4b0f91b3da391d2efe8bf2728c1d48bd4a2da6156ec75ca076
-
C:\Users\Admin\AppData\Local\Temp\xolphqs.exeFilesize
322KB
MD50f02466fa84fe048bebaf19fe03f8b2c
SHA1f69361d60e0b3e22808d6db11c294837dd9a8a06
SHA256786eb65df0a1e6b38cd4128108b9ecc78361eabf3cdcc066f210d18323669bd8
SHA512ba23c1b29f8d32a3a6a0f071a4c46d8d7da5e5c3fab4d5331bd72fc35c8954c0da2ec22dffd3b83c2ad932dcc0555c2cc8e6b5d99ebe9a87845973d2b48125a4
-
C:\Users\Admin\AppData\Local\Temp\xolphqs.exeFilesize
322KB
MD50f02466fa84fe048bebaf19fe03f8b2c
SHA1f69361d60e0b3e22808d6db11c294837dd9a8a06
SHA256786eb65df0a1e6b38cd4128108b9ecc78361eabf3cdcc066f210d18323669bd8
SHA512ba23c1b29f8d32a3a6a0f071a4c46d8d7da5e5c3fab4d5331bd72fc35c8954c0da2ec22dffd3b83c2ad932dcc0555c2cc8e6b5d99ebe9a87845973d2b48125a4
-
C:\Users\Admin\AppData\Local\Temp\xolphqs.exeFilesize
322KB
MD50f02466fa84fe048bebaf19fe03f8b2c
SHA1f69361d60e0b3e22808d6db11c294837dd9a8a06
SHA256786eb65df0a1e6b38cd4128108b9ecc78361eabf3cdcc066f210d18323669bd8
SHA512ba23c1b29f8d32a3a6a0f071a4c46d8d7da5e5c3fab4d5331bd72fc35c8954c0da2ec22dffd3b83c2ad932dcc0555c2cc8e6b5d99ebe9a87845973d2b48125a4
-
C:\Users\Public\vbc.exeFilesize
372KB
MD523601ca76095ced5f2dfcd1c709e2188
SHA1ebefe37df46e0e48bcc21fca82fdc832b038004b
SHA25628eab3eceafb6ec64f887fc3817cc8f578300fd5f85f228513e4b2eb54ebe809
SHA51234789a94e88e0079ab265ac23dbe725358c23d0ca069efb19e4a63479618dee57ce3ba848ef8c1f946129fd41f7e4baf9417446d71ed453b6c7ccccc3716b407
-
C:\Users\Public\vbc.exeFilesize
372KB
MD523601ca76095ced5f2dfcd1c709e2188
SHA1ebefe37df46e0e48bcc21fca82fdc832b038004b
SHA25628eab3eceafb6ec64f887fc3817cc8f578300fd5f85f228513e4b2eb54ebe809
SHA51234789a94e88e0079ab265ac23dbe725358c23d0ca069efb19e4a63479618dee57ce3ba848ef8c1f946129fd41f7e4baf9417446d71ed453b6c7ccccc3716b407
-
\Users\Admin\AppData\Local\Temp\xolphqs.exeFilesize
322KB
MD50f02466fa84fe048bebaf19fe03f8b2c
SHA1f69361d60e0b3e22808d6db11c294837dd9a8a06
SHA256786eb65df0a1e6b38cd4128108b9ecc78361eabf3cdcc066f210d18323669bd8
SHA512ba23c1b29f8d32a3a6a0f071a4c46d8d7da5e5c3fab4d5331bd72fc35c8954c0da2ec22dffd3b83c2ad932dcc0555c2cc8e6b5d99ebe9a87845973d2b48125a4
-
\Users\Admin\AppData\Local\Temp\xolphqs.exeFilesize
322KB
MD50f02466fa84fe048bebaf19fe03f8b2c
SHA1f69361d60e0b3e22808d6db11c294837dd9a8a06
SHA256786eb65df0a1e6b38cd4128108b9ecc78361eabf3cdcc066f210d18323669bd8
SHA512ba23c1b29f8d32a3a6a0f071a4c46d8d7da5e5c3fab4d5331bd72fc35c8954c0da2ec22dffd3b83c2ad932dcc0555c2cc8e6b5d99ebe9a87845973d2b48125a4
-
\Users\Public\vbc.exeFilesize
372KB
MD523601ca76095ced5f2dfcd1c709e2188
SHA1ebefe37df46e0e48bcc21fca82fdc832b038004b
SHA25628eab3eceafb6ec64f887fc3817cc8f578300fd5f85f228513e4b2eb54ebe809
SHA51234789a94e88e0079ab265ac23dbe725358c23d0ca069efb19e4a63479618dee57ce3ba848ef8c1f946129fd41f7e4baf9417446d71ed453b6c7ccccc3716b407
-
memory/748-70-0x0000000000000000-mapping.dmp
-
memory/748-76-0x000007FEFB751000-0x000007FEFB753000-memory.dmpFilesize
8KB
-
memory/964-81-0x00000000003E0000-0x00000000003F5000-memory.dmpFilesize
84KB
-
memory/964-84-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/964-74-0x000000000041F070-mapping.dmp
-
memory/964-77-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/964-78-0x0000000000A30000-0x0000000000D33000-memory.dmpFilesize
3.0MB
-
memory/964-79-0x00000000002A0000-0x00000000002B5000-memory.dmpFilesize
84KB
-
memory/1056-87-0x00000000000C0000-0x00000000000EF000-memory.dmpFilesize
188KB
-
memory/1056-86-0x00000000000C0000-0x00000000000EF000-memory.dmpFilesize
188KB
-
memory/1056-85-0x0000000000D70000-0x0000000000D76000-memory.dmpFilesize
24KB
-
memory/1056-83-0x0000000000000000-mapping.dmp
-
memory/1144-61-0x0000000000000000-mapping.dmp
-
memory/1412-82-0x0000000007200000-0x000000000736A000-memory.dmpFilesize
1.4MB
-
memory/1412-80-0x0000000007080000-0x00000000071F3000-memory.dmpFilesize
1.4MB
-
memory/1640-58-0x0000000070CAD000-0x0000000070CB8000-memory.dmpFilesize
44KB
-
memory/1640-54-0x0000000072241000-0x0000000072244000-memory.dmpFilesize
12KB
-
memory/1640-55-0x000000006FCC1000-0x000000006FCC3000-memory.dmpFilesize
8KB
-
memory/1640-56-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1640-57-0x0000000075091000-0x0000000075093000-memory.dmpFilesize
8KB
-
memory/1912-66-0x0000000000000000-mapping.dmp