Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
10-03-2023 01:06
Static task
static1
Behavioral task
behavioral1
Sample
2678ea9a98659545592b7982a17a1b65b92f0fba7eea9d15760f2dbcb7546956.xls
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
2678ea9a98659545592b7982a17a1b65b92f0fba7eea9d15760f2dbcb7546956.xls
Resource
win10v2004-20230220-en
General
-
Target
2678ea9a98659545592b7982a17a1b65b92f0fba7eea9d15760f2dbcb7546956.xls
-
Size
1.2MB
-
MD5
12c87026c144f87df2338e40f2293b19
-
SHA1
b8caf6a6c738f7050523381c4e7fcbba08ec6433
-
SHA256
2678ea9a98659545592b7982a17a1b65b92f0fba7eea9d15760f2dbcb7546956
-
SHA512
b7ea848f6140b81ca8f1a7d9b8f6f6710f709f5289a3bfe707de04416b8b155b6d3afcd3c7d8ce7774903842bbd94a112481d9a3e8bd83b17b1e7616ae2e288c
-
SSDEEP
24576:QLKrBwtHlx7WQmmav30xJB48tHlxGWQmmav30xF6FIW60z0tUo4QcZRx:QLKro7aQmmQ30D2S77QmmQ30H6Q+Qif
Malware Config
Extracted
formbook
4.1
g2fg
snowcrash.website
pointman.us
newheartvalve.care
drandl.com
sandspringsramblers.com
programagubernamental.online
boja.us
mvrsnike.com
mentallyillmotherhood.com
facom.us
programagubernamental.store
izivente.com
roller-v.fr
amazonbioactives.com
metaverseapple.xyz
5gt-mobilevsverizon.com
gtwebsolutions.co
scottdunn.life
usdp.trade
pikmin.run
cardano-dogs.com
bf2hgfy.xyz
teslafoot.com
rubertquintana.com
wellsfargroewards.com
santel.us
couponatonline.com
theunitedhomeland.com
pmstnly.com
strlocal.com
shelleysmucker.com
youser.online
emansdesign.com
usnikeshoesbot.top
starfish.press
scotwork.us
metamorgana.com
onyxbx.net
rivas.company
firstcoastalfb.com
onpurposetraumainformedcare.com
celimot.xyz
jecunikepemej.rest
lenovolatenightit.com
unitedsterlingcompanyky.com
safety2venture.us
facebookismetanow.com
scottdunn.review
mentallyillmotherhood.com
firstincargo.com
vikavivi.com
investmenofpairs.club
nexans.cloud
farcloud.fr
ivermectinforhumans.quest
5gmalesdf.sbs
majenta.info
6vvvvvwmetam.top
metafirstclass.com
firstcoinnews.com
btcetffutures.online
funinfortmyers.com
mangoirslk.top
metaversebasicprivacy.com
blancheshelley.xyz
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1624-102-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1624-106-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1664-113-0x00000000000F0000-0x000000000011F000-memory.dmp formbook behavioral1/memory/1664-115-0x00000000000F0000-0x000000000011F000-memory.dmp formbook -
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 3 1184 EQNEDT32.EXE -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
vbc.exevbc.exepid process 880 vbc.exe 1624 vbc.exe -
Loads dropped DLL 5 IoCs
Processes:
EQNEDT32.EXEpid process 1184 EQNEDT32.EXE 1184 EQNEDT32.EXE 1184 EQNEDT32.EXE 1184 EQNEDT32.EXE 1184 EQNEDT32.EXE -
Uses the VBS compiler for execution 1 TTPs
-
Drops file in System32 directory 1 IoCs
Processes:
powershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
vbc.exevbc.exesvchost.exedescription pid process target process PID 880 set thread context of 1624 880 vbc.exe vbc.exe PID 1624 set thread context of 1240 1624 vbc.exe Explorer.EXE PID 1664 set thread context of 1240 1664 svchost.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE -
Modifies registry class 64 IoCs
Processes:
EXCEL.EXEdescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597} EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 2044 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
vbc.exepowershell.exesvchost.exepid process 1624 vbc.exe 1624 vbc.exe 1928 powershell.exe 1664 svchost.exe 1664 svchost.exe 1664 svchost.exe 1664 svchost.exe 1664 svchost.exe 1664 svchost.exe 1664 svchost.exe 1664 svchost.exe 1664 svchost.exe 1664 svchost.exe 1664 svchost.exe 1664 svchost.exe 1664 svchost.exe 1664 svchost.exe 1664 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1240 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
vbc.exesvchost.exepid process 1624 vbc.exe 1624 vbc.exe 1624 vbc.exe 1664 svchost.exe 1664 svchost.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
vbc.exepowershell.exesvchost.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1624 vbc.exe Token: SeDebugPrivilege 1928 powershell.exe Token: SeDebugPrivilege 1664 svchost.exe Token: SeShutdownPrivilege 1240 Explorer.EXE Token: SeShutdownPrivilege 1240 Explorer.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 2044 EXCEL.EXE 2044 EXCEL.EXE 2044 EXCEL.EXE -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
EQNEDT32.EXEvbc.exeExplorer.EXEsvchost.exedescription pid process target process PID 1184 wrote to memory of 880 1184 EQNEDT32.EXE vbc.exe PID 1184 wrote to memory of 880 1184 EQNEDT32.EXE vbc.exe PID 1184 wrote to memory of 880 1184 EQNEDT32.EXE vbc.exe PID 1184 wrote to memory of 880 1184 EQNEDT32.EXE vbc.exe PID 880 wrote to memory of 1928 880 vbc.exe powershell.exe PID 880 wrote to memory of 1928 880 vbc.exe powershell.exe PID 880 wrote to memory of 1928 880 vbc.exe powershell.exe PID 880 wrote to memory of 1928 880 vbc.exe powershell.exe PID 880 wrote to memory of 1876 880 vbc.exe schtasks.exe PID 880 wrote to memory of 1876 880 vbc.exe schtasks.exe PID 880 wrote to memory of 1876 880 vbc.exe schtasks.exe PID 880 wrote to memory of 1876 880 vbc.exe schtasks.exe PID 880 wrote to memory of 1624 880 vbc.exe vbc.exe PID 880 wrote to memory of 1624 880 vbc.exe vbc.exe PID 880 wrote to memory of 1624 880 vbc.exe vbc.exe PID 880 wrote to memory of 1624 880 vbc.exe vbc.exe PID 880 wrote to memory of 1624 880 vbc.exe vbc.exe PID 880 wrote to memory of 1624 880 vbc.exe vbc.exe PID 880 wrote to memory of 1624 880 vbc.exe vbc.exe PID 1240 wrote to memory of 1664 1240 Explorer.EXE svchost.exe PID 1240 wrote to memory of 1664 1240 Explorer.EXE svchost.exe PID 1240 wrote to memory of 1664 1240 Explorer.EXE svchost.exe PID 1240 wrote to memory of 1664 1240 Explorer.EXE svchost.exe PID 1664 wrote to memory of 1956 1664 svchost.exe cmd.exe PID 1664 wrote to memory of 1956 1664 svchost.exe cmd.exe PID 1664 wrote to memory of 1956 1664 svchost.exe cmd.exe PID 1664 wrote to memory of 1956 1664 svchost.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\2678ea9a98659545592b7982a17a1b65b92f0fba7eea9d15760f2dbcb7546956.xls2⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Public\vbc.exe"3⤵
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\UQaZOpBfTXPxe.exe"3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UQaZOpBfTXPxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE928.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\2095B285.emfFilesize
34KB
MD5d07b4beb4ff3f1a5ec31e2eebe944e91
SHA15bdcab90d8b5d983d6db791b28861d536e680c74
SHA25637efd4401bfe0a063b3585dca0753ca49dced57862a3f58558eced424c557bee
SHA51211a1375a7c5d5924d82f845afa77b36e960ee1730d13fb7a337d28a4dd142a61a7a1f095d1039285f92fe420077cd717e1ffbdceccbd300a6fdf1085facee2a2
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\B40FBF94.emfFilesize
577KB
MD5c754c0c24e79a52d15d601b962cf610c
SHA161939f164242c509360fd18fcc32474aa6d8ec29
SHA25636e82aa3352a6c2b7b36bc8b16ba84addd441adc8c69fb1c900300406a1d1739
SHA51205c78a58a4230cdf5545a0e61376740bbd25f0fe9ec6a78059043804d31b565e6af1c4236f1f8fbbd50929c6acc515692c0f979046b526308a14988af2ffaae9
-
C:\Users\Admin\AppData\Local\Temp\tmpE928.tmpFilesize
1KB
MD562fc14b1d2d1fec166007e8ea8a4b4ba
SHA1499c31bfcadda4a04cb2d3d60e27ed7257a29981
SHA25631185ed785006c006de7332ee0ee9a5f5368763fb506802fb2ee1d30b139c4ae
SHA512db8a066d64b2084cbaeaa4136e7d398ccf71f91021fcf24ad0ea0109796e7e4c10be37e65292c3363581fb5275e4e6e807c9e597e82d73788c063d6fdcb6a357
-
C:\Users\Public\vbc.exeFilesize
885KB
MD59fb2fa6e06d3f2a46d78ddd454b2defd
SHA1dcf1825c32d53f3fba95540e89d721d145e8d683
SHA256ef5801704c64fb48c3bc3f96ba58f18ed4a320835d0f5d36732b3b5c2a2724ef
SHA51271b49b4dd668755e2ec107dcf81483f392c8f49373319ac6bd97ef6e995e076cd5d0b52a19193a4494fbc82a7069e36a5bd1371eef83ef80e36c12bdaee2b708
-
C:\Users\Public\vbc.exeFilesize
885KB
MD59fb2fa6e06d3f2a46d78ddd454b2defd
SHA1dcf1825c32d53f3fba95540e89d721d145e8d683
SHA256ef5801704c64fb48c3bc3f96ba58f18ed4a320835d0f5d36732b3b5c2a2724ef
SHA51271b49b4dd668755e2ec107dcf81483f392c8f49373319ac6bd97ef6e995e076cd5d0b52a19193a4494fbc82a7069e36a5bd1371eef83ef80e36c12bdaee2b708
-
C:\Users\Public\vbc.exeFilesize
885KB
MD59fb2fa6e06d3f2a46d78ddd454b2defd
SHA1dcf1825c32d53f3fba95540e89d721d145e8d683
SHA256ef5801704c64fb48c3bc3f96ba58f18ed4a320835d0f5d36732b3b5c2a2724ef
SHA51271b49b4dd668755e2ec107dcf81483f392c8f49373319ac6bd97ef6e995e076cd5d0b52a19193a4494fbc82a7069e36a5bd1371eef83ef80e36c12bdaee2b708
-
C:\Users\Public\vbc.exeFilesize
885KB
MD59fb2fa6e06d3f2a46d78ddd454b2defd
SHA1dcf1825c32d53f3fba95540e89d721d145e8d683
SHA256ef5801704c64fb48c3bc3f96ba58f18ed4a320835d0f5d36732b3b5c2a2724ef
SHA51271b49b4dd668755e2ec107dcf81483f392c8f49373319ac6bd97ef6e995e076cd5d0b52a19193a4494fbc82a7069e36a5bd1371eef83ef80e36c12bdaee2b708
-
\Users\Public\vbc.exeFilesize
885KB
MD59fb2fa6e06d3f2a46d78ddd454b2defd
SHA1dcf1825c32d53f3fba95540e89d721d145e8d683
SHA256ef5801704c64fb48c3bc3f96ba58f18ed4a320835d0f5d36732b3b5c2a2724ef
SHA51271b49b4dd668755e2ec107dcf81483f392c8f49373319ac6bd97ef6e995e076cd5d0b52a19193a4494fbc82a7069e36a5bd1371eef83ef80e36c12bdaee2b708
-
\Users\Public\vbc.exeFilesize
885KB
MD59fb2fa6e06d3f2a46d78ddd454b2defd
SHA1dcf1825c32d53f3fba95540e89d721d145e8d683
SHA256ef5801704c64fb48c3bc3f96ba58f18ed4a320835d0f5d36732b3b5c2a2724ef
SHA51271b49b4dd668755e2ec107dcf81483f392c8f49373319ac6bd97ef6e995e076cd5d0b52a19193a4494fbc82a7069e36a5bd1371eef83ef80e36c12bdaee2b708
-
\Users\Public\vbc.exeFilesize
885KB
MD59fb2fa6e06d3f2a46d78ddd454b2defd
SHA1dcf1825c32d53f3fba95540e89d721d145e8d683
SHA256ef5801704c64fb48c3bc3f96ba58f18ed4a320835d0f5d36732b3b5c2a2724ef
SHA51271b49b4dd668755e2ec107dcf81483f392c8f49373319ac6bd97ef6e995e076cd5d0b52a19193a4494fbc82a7069e36a5bd1371eef83ef80e36c12bdaee2b708
-
\Users\Public\vbc.exeFilesize
885KB
MD59fb2fa6e06d3f2a46d78ddd454b2defd
SHA1dcf1825c32d53f3fba95540e89d721d145e8d683
SHA256ef5801704c64fb48c3bc3f96ba58f18ed4a320835d0f5d36732b3b5c2a2724ef
SHA51271b49b4dd668755e2ec107dcf81483f392c8f49373319ac6bd97ef6e995e076cd5d0b52a19193a4494fbc82a7069e36a5bd1371eef83ef80e36c12bdaee2b708
-
\Users\Public\vbc.exeFilesize
885KB
MD59fb2fa6e06d3f2a46d78ddd454b2defd
SHA1dcf1825c32d53f3fba95540e89d721d145e8d683
SHA256ef5801704c64fb48c3bc3f96ba58f18ed4a320835d0f5d36732b3b5c2a2724ef
SHA51271b49b4dd668755e2ec107dcf81483f392c8f49373319ac6bd97ef6e995e076cd5d0b52a19193a4494fbc82a7069e36a5bd1371eef83ef80e36c12bdaee2b708
-
memory/880-85-0x00000000006E0000-0x0000000000720000-memory.dmpFilesize
256KB
-
memory/880-86-0x00000000003D0000-0x00000000003E4000-memory.dmpFilesize
80KB
-
memory/880-90-0x00000000061A0000-0x0000000006250000-memory.dmpFilesize
704KB
-
memory/880-88-0x00000000006E0000-0x0000000000720000-memory.dmpFilesize
256KB
-
memory/880-96-0x0000000004C20000-0x0000000004C58000-memory.dmpFilesize
224KB
-
memory/880-84-0x00000000000E0000-0x00000000001C4000-memory.dmpFilesize
912KB
-
memory/880-89-0x00000000005D0000-0x00000000005DC000-memory.dmpFilesize
48KB
-
memory/1240-110-0x0000000006A50000-0x0000000006B57000-memory.dmpFilesize
1.0MB
-
memory/1240-117-0x0000000000010000-0x0000000000020000-memory.dmpFilesize
64KB
-
memory/1240-149-0x000007FF0E330000-0x000007FF0E33A000-memory.dmpFilesize
40KB
-
memory/1240-122-0x0000000005EC0000-0x0000000005F6D000-memory.dmpFilesize
692KB
-
memory/1240-120-0x0000000005EC0000-0x0000000005F6D000-memory.dmpFilesize
692KB
-
memory/1240-119-0x0000000005EC0000-0x0000000005F6D000-memory.dmpFilesize
692KB
-
memory/1624-109-0x00000000001F0000-0x0000000000204000-memory.dmpFilesize
80KB
-
memory/1624-101-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1624-100-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1624-102-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1624-99-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1624-106-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1624-107-0x0000000000980000-0x0000000000C83000-memory.dmpFilesize
3.0MB
-
memory/1664-118-0x0000000000680000-0x0000000000713000-memory.dmpFilesize
588KB
-
memory/1664-115-0x00000000000F0000-0x000000000011F000-memory.dmpFilesize
188KB
-
memory/1664-114-0x0000000000810000-0x0000000000B13000-memory.dmpFilesize
3.0MB
-
memory/1664-113-0x00000000000F0000-0x000000000011F000-memory.dmpFilesize
188KB
-
memory/1664-112-0x0000000000090000-0x0000000000098000-memory.dmpFilesize
32KB
-
memory/1664-111-0x0000000000090000-0x0000000000098000-memory.dmpFilesize
32KB
-
memory/1928-108-0x00000000026A0000-0x00000000026E0000-memory.dmpFilesize
256KB
-
memory/1928-105-0x00000000026A0000-0x00000000026E0000-memory.dmpFilesize
256KB
-
memory/2044-130-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/2044-54-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB