agenttesla | 5d39d0f94d3ab0ac294f5438619965dfcb56b6347faae2179c115caed2715ca8

Analysis

max time kernel
102s
max time network
104s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
03-03-2023 09:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Josefinabosco Groups Limited RFQ#20230304.docx
Size

10KB
MD5

6d5efe89e5096d4e503cfa45e3be6012
SHA1

582580bdcdf8e6075a9bb736a5421e4674ce3750
SHA256

5d39d0f94d3ab0ac294f5438619965dfcb56b6347faae2179c115caed2715ca8
SHA512

239770ced2b5b104b9dd6394c1528d9bb8a691e0f0518ebe68d6cdabf3fd6298f43667671794f1cd6ef355bd10758e4d5b8a861fa11894d67da96f1af9dace78
SSDEEP

192:ScIMmtP1aIG/bslPL++uOXFl+CVWBXJC0c3o+:SPXU/slT+LOXFHkZC9j

Score

10^/10

agenttesla collection keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
us2.smtp.mailhostbox.com
Port:
587
Username:
002@frem-tr.com
Password:
jCXzqcP1 daniel 3116
Email To:
002@frem-tr.com

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Blocklisted process makes network request 1 IoCs

Processes:

EQNEDT32.EXE

flow pid process

7 828 EQNEDT32.EXE
Downloads MZ/PE file

flow	pid	process
7	828	EQNEDT32.EXE

Abuses OpenXML format to download file from external location 2 IoCs

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Office\14.0\Common	WINWORD.EXE
Key opened	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Office\Common\Offline\Files\http://3324948138/12u.12u.12u.doc	WINWORD.EXE

Executes dropped EXE 3 IoCs

Processes:

vbc.exevbc.exevbc.exe

pid process

888 vbc.exe
1204 vbc.exe
1064 vbc.exe
Loads dropped DLL 2 IoCs

Processes:

EQNEDT32.EXE

pid process

828 EQNEDT32.EXE
828 EQNEDT32.EXE
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

pid	process
888	vbc.exe
1204	vbc.exe
1064	vbc.exe

pid	process
828	EQNEDT32.EXE
828	EQNEDT32.EXE

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

vbc.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vbc.exe
Key opened	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vbc.exe
Key opened	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vbc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

vbc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Windows\CurrentVersion\Run\gcWPrHZ = "C:\\Users\\Admin\\AppData\\Roaming\\gcWPrHZ\\gcWPrHZ.exe"	vbc.exe

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

vbc.exe

description pid process target process

PID 888 set thread context of 1064 888 vbc.exe vbc.exe
Drops file in Windows directory 1 IoCs

Processes:

WINWORD.EXE

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1624 schtasks.exe
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
exploit

Exploitation for Client Execution
T1203

Processes:

EQNEDT32.EXE

pid process

828 EQNEDT32.EXE

description	pid	process	target process
PID 888 set thread context of 1064	888	vbc.exe	vbc.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

pid	process
1624	schtasks.exe

pid	process
828	EQNEDT32.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE

Modifies registry class 64 IoCs

Processes:

WINWORD.EXE

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

816 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

vbc.exepowershell.exe

pid process

888 vbc.exe
888 vbc.exe
888 vbc.exe
888 vbc.exe
1988 powershell.exe

pid	process
816	WINWORD.EXE

pid	process
888	vbc.exe
888	vbc.exe
888	vbc.exe
888	vbc.exe
1988	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

vbc.exevbc.exepowershell.exeWINWORD.EXE

description	pid	process
Token: SeDebugPrivilege	888	vbc.exe
Token: SeDebugPrivilege	1064	vbc.exe
Token: SeDebugPrivilege	1988	powershell.exe
Token: SeShutdownPrivilege	816	WINWORD.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

816 WINWORD.EXE
816 WINWORD.EXE

pid	process
816	WINWORD.EXE
816	WINWORD.EXE

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

EQNEDT32.EXEWINWORD.EXEvbc.exe

description	pid	process	target process
PID 828 wrote to memory of 888	828	EQNEDT32.EXE	vbc.exe
PID 828 wrote to memory of 888	828	EQNEDT32.EXE	vbc.exe
PID 828 wrote to memory of 888	828	EQNEDT32.EXE	vbc.exe
PID 828 wrote to memory of 888	828	EQNEDT32.EXE	vbc.exe
PID 816 wrote to memory of 792	816	WINWORD.EXE	splwow64.exe
PID 816 wrote to memory of 792	816	WINWORD.EXE	splwow64.exe
PID 816 wrote to memory of 792	816	WINWORD.EXE	splwow64.exe
PID 816 wrote to memory of 792	816	WINWORD.EXE	splwow64.exe
PID 888 wrote to memory of 1988	888	vbc.exe	powershell.exe
PID 888 wrote to memory of 1988	888	vbc.exe	powershell.exe
PID 888 wrote to memory of 1988	888	vbc.exe	powershell.exe
PID 888 wrote to memory of 1988	888	vbc.exe	powershell.exe
PID 888 wrote to memory of 1624	888	vbc.exe	schtasks.exe
PID 888 wrote to memory of 1624	888	vbc.exe	schtasks.exe
PID 888 wrote to memory of 1624	888	vbc.exe	schtasks.exe
PID 888 wrote to memory of 1624	888	vbc.exe	schtasks.exe
PID 888 wrote to memory of 1204	888	vbc.exe	vbc.exe
PID 888 wrote to memory of 1204	888	vbc.exe	vbc.exe
PID 888 wrote to memory of 1204	888	vbc.exe	vbc.exe
PID 888 wrote to memory of 1204	888	vbc.exe	vbc.exe
PID 888 wrote to memory of 1064	888	vbc.exe	vbc.exe
PID 888 wrote to memory of 1064	888	vbc.exe	vbc.exe
PID 888 wrote to memory of 1064	888	vbc.exe	vbc.exe
PID 888 wrote to memory of 1064	888	vbc.exe	vbc.exe
PID 888 wrote to memory of 1064	888	vbc.exe	vbc.exe
PID 888 wrote to memory of 1064	888	vbc.exe	vbc.exe
PID 888 wrote to memory of 1064	888	vbc.exe	vbc.exe
PID 888 wrote to memory of 1064	888	vbc.exe	vbc.exe
PID 888 wrote to memory of 1064	888	vbc.exe	vbc.exe

outlook_office_path 1 IoCs

Processes:

vbc.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vbc.exe

outlook_win_path 1 IoCs

Processes:

vbc.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vbc.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Josefinabosco Groups Limited RFQ#20230304.docx"
1⤵
- Abuses OpenXML format to download file from external location
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:816

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:792

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:828

C:\Users\Public\vbc.exe
"C:\Users\Public\vbc.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:888

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\iygpxcCSjijj.exe"
3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1988

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iygpxcCSjijj" /XML "C:\Users\Admin\AppData\Local\Temp\tmp82C7.tmp"
3⤵
- Creates scheduled task(s)
PID:1624

C:\Users\Public\vbc.exe
"C:\Users\Public\vbc.exe"
3⤵
- Executes dropped EXE
PID:1204

C:\Users\Public\vbc.exe
"C:\Users\Public\vbc.exe"
3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1064

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

T1064

Scheduled Task

T1053

Exploitation for Client Execution

T1203

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Scripting

T1064

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-{206056F8-6E60-4AFF-94B8-9A7259BA508A}.FSD
Filesize
128KB

MD5
994510d5e9e044efd2b33153e4723e83

SHA1
ce8d2b893aa5cac71d7b9c7df8c1ca4ab4c25fab

SHA256
0dd4397169fcff910de8a5946ace49ce91c6cad030db1f6d810f217066761660

SHA512
b3cfbc0bc369553b96534135149ebeb06d13d475391a032c2504a72f7778bc68b025743d093650b67d2e4d5178e2573a40a435aa95507ac2a33343d8d671486d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD
Filesize
128KB

MD5
fdc4b091c0bb38e559f205e6e2188a29

SHA1
3c7e037f52b9c98e559c24c2b13366515057d659

SHA256
ec5cdfe940d6a8618f3c105ac84f6b725a7eef047f8355ecab388d1868614e2d

SHA512
dde108ad64fc84b84c2a53c84e3215ec17797c33daaa13ab0660e247077ba1d920803152f2638ca86185ff32bd3625b27e77b46fef3882e98302e76351c948db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-{11D8B5B4-942B-4923-B4BE-1FD529BA6034}.FSD
Filesize
128KB

MD5
444d375511cc7780aa24d5757d4e5a39

SHA1
e1385605c248f345f2639609f1b76cab897dcb89

SHA256
dda956330107d223d21d0572bbab1d751697a55502790bc3930db471e1a974e8

SHA512
1212681187483140424c57b4d8f9a6075cc95f1800dc77b8c4d95bb2954edd2e40f2a3f4456296ee34df33e8b20bd7bff7c1b6e5dcf9c4957d4dd2faa3da6bce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EV74ZOZO\12u.12u.12u[1].doc
Filesize
14KB

MD5
a086b1062656053ee82dafd92eb00252

SHA1
ecd541abbd001215adfeadaf7296844850941417

SHA256
80ff48a7d79ab0be1645decf79d42e3b9d5e5a00e2dec724f9af5d8f2669d48e

SHA512
abef8be677fe35f812cdf54d2b5426cb6af058dd8fd07925dd4ffbda8a137b1270286653a6c318314132aeb67500ca81e90b1b20a720ffefefad0f72171caf02

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp82C7.tmp
Filesize
1KB

MD5
5ce346decd5a5c3f73c8b1aa250f5c02

SHA1
88cf88f135a2f9f5ed29ec167827cce715fb0634

SHA256
cd1fa7804bcf44ed67dd3340cbb00106163c649cfe5b51ea287546c8bda7d094

SHA512
2aaf1e6d94b8d45595146854df7b2332b6655e63778d6c5eb928c53993c2db9003e2c00ed376e053eb16f40f9485a951a988d3903c745f16eb9ad5c97e185528

Download Submit
C:\Users\Admin\AppData\Local\Temp\{194194BB-83A0-40C9-8BED-5DFE6E7A6043}
Filesize
128KB

MD5
3bcc0a98248770362c492d1e73199f2e

SHA1
11a42eff113e169d01fffd60f8b8412774de0074

SHA256
bc9d1b9afe4dc986b81ebfe20f0a499eeedc61fee740a7952fd380060f0dba47

SHA512
31a815addd1a1a4defa5335f54b378175bebc22916e0b137822fd78bc62fab5f627a3782a1673414d8f68eab89cde276452788b4b6216764571bef1a752ddc30

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
Filesize
20KB

MD5
c573bc93cba89edd86a82089e47f66b2

SHA1
e0d887a46cad494dd8a8f2288464141b9f2af1cf

SHA256
0a9a12cc144134b1c2bbc3bb2c7c4629b95da2eb3d6ba0296431d1d33dea2e90

SHA512
539a1fce7b31d0b0a5f4aa0f838e8e2c42c533768d12c5469128c6f7ffc1a2586c8c87ccf6765761b5b0954ef8073150dbacdf140efff34670774bd0fff2f4f5

Download Submit
C:\Users\Public\vbc.exe
Filesize
1.1MB

MD5
131ff0ef35352e56cef2893ab1260c3d

SHA1
8cae139353e77e1e4bd08f86934160f9f23cffa9

SHA256
8c428b36093ad04e27a3ad86f06c716a9de37b502428211ecc15466fda55068b

SHA512
1b58c4a27bff9b3c82e531da84b3a03a8aeead32b5bec9c58fb3053de750a303b59aff7625061db824f44cf43f8164c47f8b7b4b2a27066985d75f60649b43c0

Download Submit
C:\Users\Public\vbc.exe
Filesize
1.1MB

MD5
131ff0ef35352e56cef2893ab1260c3d

SHA1
8cae139353e77e1e4bd08f86934160f9f23cffa9

SHA256
8c428b36093ad04e27a3ad86f06c716a9de37b502428211ecc15466fda55068b

SHA512
1b58c4a27bff9b3c82e531da84b3a03a8aeead32b5bec9c58fb3053de750a303b59aff7625061db824f44cf43f8164c47f8b7b4b2a27066985d75f60649b43c0

Download Submit
C:\Users\Public\vbc.exe
Filesize
1.1MB

MD5
131ff0ef35352e56cef2893ab1260c3d

SHA1
8cae139353e77e1e4bd08f86934160f9f23cffa9

SHA256
8c428b36093ad04e27a3ad86f06c716a9de37b502428211ecc15466fda55068b

SHA512
1b58c4a27bff9b3c82e531da84b3a03a8aeead32b5bec9c58fb3053de750a303b59aff7625061db824f44cf43f8164c47f8b7b4b2a27066985d75f60649b43c0

Download Submit
C:\Users\Public\vbc.exe
Filesize
1.1MB

MD5
131ff0ef35352e56cef2893ab1260c3d

SHA1
8cae139353e77e1e4bd08f86934160f9f23cffa9

SHA256
8c428b36093ad04e27a3ad86f06c716a9de37b502428211ecc15466fda55068b

SHA512
1b58c4a27bff9b3c82e531da84b3a03a8aeead32b5bec9c58fb3053de750a303b59aff7625061db824f44cf43f8164c47f8b7b4b2a27066985d75f60649b43c0

Download Submit
C:\Users\Public\vbc.exe
Filesize
1.1MB

MD5
131ff0ef35352e56cef2893ab1260c3d

SHA1
8cae139353e77e1e4bd08f86934160f9f23cffa9

SHA256
8c428b36093ad04e27a3ad86f06c716a9de37b502428211ecc15466fda55068b

SHA512
1b58c4a27bff9b3c82e531da84b3a03a8aeead32b5bec9c58fb3053de750a303b59aff7625061db824f44cf43f8164c47f8b7b4b2a27066985d75f60649b43c0

Download Submit
\Users\Public\vbc.exe
Filesize
1.1MB

MD5
131ff0ef35352e56cef2893ab1260c3d

SHA1
8cae139353e77e1e4bd08f86934160f9f23cffa9

SHA256
8c428b36093ad04e27a3ad86f06c716a9de37b502428211ecc15466fda55068b

SHA512
1b58c4a27bff9b3c82e531da84b3a03a8aeead32b5bec9c58fb3053de750a303b59aff7625061db824f44cf43f8164c47f8b7b4b2a27066985d75f60649b43c0

Download Submit
\Users\Public\vbc.exe
Filesize
1.1MB

MD5
131ff0ef35352e56cef2893ab1260c3d

SHA1
8cae139353e77e1e4bd08f86934160f9f23cffa9

SHA256
8c428b36093ad04e27a3ad86f06c716a9de37b502428211ecc15466fda55068b

SHA512
1b58c4a27bff9b3c82e531da84b3a03a8aeead32b5bec9c58fb3053de750a303b59aff7625061db824f44cf43f8164c47f8b7b4b2a27066985d75f60649b43c0

Download Submit
memory/816-208-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/816-54-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/888-145-0x0000000004D50000-0x0000000004D90000-memory.dmp

Filesize
256KB

Download
memory/888-146-0x0000000000420000-0x000000000043A000-memory.dmp

Filesize
104KB

Download
memory/888-153-0x0000000004D50000-0x0000000004D90000-memory.dmp

Filesize
256KB

Download
memory/888-154-0x0000000000340000-0x000000000034C000-memory.dmp

Filesize
48KB

Download
memory/888-155-0x0000000005740000-0x00000000057EA000-memory.dmp

Filesize
680KB

Download
memory/888-144-0x0000000000E40000-0x0000000000F64000-memory.dmp

Filesize
1.1MB

Download
memory/888-161-0x0000000000C00000-0x0000000000C06000-memory.dmp

Filesize
24KB

Download
memory/888-164-0x0000000000CC0000-0x0000000000CF2000-memory.dmp

Filesize
200KB

Download
memory/1064-169-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1064-170-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1064-171-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1064-167-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1064-174-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1064-176-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1064-177-0x0000000004E10000-0x0000000004E50000-memory.dmp

Filesize
256KB

Download
memory/1064-181-0x0000000004E10000-0x0000000004E50000-memory.dmp

Filesize
256KB

Download
memory/1064-168-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1064-166-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1988-178-0x0000000002500000-0x0000000002540000-memory.dmp

Filesize
256KB

Download
memory/1988-179-0x0000000002500000-0x0000000002540000-memory.dmp

Filesize
256KB

Download