Analysis
-
max time kernel
147s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
15-03-2023 15:21
Static task
static1
Behavioral task
behavioral1
Sample
0403 Packing List.xls
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
0403 Packing List.xls
Resource
win10v2004-20230220-en
General
-
Target
0403 Packing List.xls
-
Size
1.5MB
-
MD5
93f959f812ca137d8ddea1039fc0130e
-
SHA1
9ef73bbd3144ac67acc01b2173449613a476b9ac
-
SHA256
78db3edeb45a9848b0f4b9311565310ea938332125763a6338e6207eaed69eeb
-
SHA512
79a80f2de1eb4c88114eddd48013f2985cef01fc6d9ad4b97890d1b7bc7d5912ec9a39d1feb4b3cd0a138315d8da973c40131014fb6c17b2cbc3bc648c7df140
-
SSDEEP
24576:BLKuZyWZWZyibF3ZZyFWT+JWT+cZyAL0OZy87gRZy6xsRQKRcATQB6qvKN:BLK4yNPxB/m9CRjTTFN
Malware Config
Extracted
formbook
4.1
ar73
classgorilla.com
b6817.com
1wwuwa.top
dgslimited.africa
deepwaterships.com
hkshshoptw.shop
hurricanevalleyatvjamboree.com
ckpconsulting.com
laojiangmath.com
authenticityhacking.com
family-doctor-53205.com
investinstgeorgeut.com
lithoearthsolution.africa
quickhealcareltd.co.uk
delightkgrillw.top
freezeclosettoilet.com
coo1star.com
gemgamut.com
enrichednetworksolutions.com
betterbeeclean.com
kbmstr.com
colorusainc.com
five-dollar-meals.com
baozhuang8.com
la-home-service.com
innovantexclusive.com
chateaudevillars.co.uk
echadholisticbar.com
naijacarprices.africa
4652.voto
kraftheonz.com
ingrambaby.com
braeunungsoel.ch
sweetcariadgifts.co.uk
kui693.com
akatov-top.ru
epollresearch.online
cupandsaucybooks.com
arredobagno.club
gt.sale
dskincare.com
cursosemcasa.site
leaf-spa.net
deathbeforedeceit.com
azvvs.com
laptops-39165.com
ccwt.vip
011965.com
mtevz.online
jacksontcpassettlement.com
aldeajerusalen.com
kellnovaglobalfood.info
alphametatek.online
lcssthh.com
dumelogold9ja.africa
d-storic.com
mogi.africa
ghostt.net
aksharsigns.online
goglucofort.com
b708.com
controlplus.systems
lightandstory.info
invstcai.sbs
2348x.com
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1632-83-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1632-87-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1956-92-0x00000000000D0000-0x00000000000FF000-memory.dmp formbook behavioral1/memory/1956-94-0x00000000000D0000-0x00000000000FF000-memory.dmp formbook -
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 3 2008 EQNEDT32.EXE -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
vbc.exevbc.exepid process 896 vbc.exe 1632 vbc.exe -
Loads dropped DLL 1 IoCs
Processes:
EQNEDT32.EXEpid process 2008 EQNEDT32.EXE -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
vbc.exevbc.exeNETSTAT.EXEdescription pid process target process PID 896 set thread context of 1632 896 vbc.exe vbc.exe PID 1632 set thread context of 1264 1632 vbc.exe Explorer.EXE PID 1956 set thread context of 1264 1956 NETSTAT.EXE Explorer.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
NETSTAT.EXEpid process 1956 NETSTAT.EXE -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE -
Modifies registry class 64 IoCs
Processes:
EXCEL.EXEdescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32 EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597} EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\"" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1060 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
vbc.exeNETSTAT.EXEpid process 1632 vbc.exe 1632 vbc.exe 1956 NETSTAT.EXE 1956 NETSTAT.EXE 1956 NETSTAT.EXE 1956 NETSTAT.EXE 1956 NETSTAT.EXE 1956 NETSTAT.EXE 1956 NETSTAT.EXE 1956 NETSTAT.EXE 1956 NETSTAT.EXE 1956 NETSTAT.EXE 1956 NETSTAT.EXE 1956 NETSTAT.EXE 1956 NETSTAT.EXE 1956 NETSTAT.EXE 1956 NETSTAT.EXE 1956 NETSTAT.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1264 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
vbc.exeNETSTAT.EXEpid process 1632 vbc.exe 1632 vbc.exe 1632 vbc.exe 1956 NETSTAT.EXE 1956 NETSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
vbc.exeNETSTAT.EXEExplorer.EXEdescription pid process Token: SeDebugPrivilege 1632 vbc.exe Token: SeDebugPrivilege 1956 NETSTAT.EXE Token: SeShutdownPrivilege 1264 Explorer.EXE Token: SeShutdownPrivilege 1264 Explorer.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1060 EXCEL.EXE 1060 EXCEL.EXE 1060 EXCEL.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
EQNEDT32.EXEvbc.exeExplorer.EXENETSTAT.EXEdescription pid process target process PID 2008 wrote to memory of 896 2008 EQNEDT32.EXE vbc.exe PID 2008 wrote to memory of 896 2008 EQNEDT32.EXE vbc.exe PID 2008 wrote to memory of 896 2008 EQNEDT32.EXE vbc.exe PID 2008 wrote to memory of 896 2008 EQNEDT32.EXE vbc.exe PID 896 wrote to memory of 1632 896 vbc.exe vbc.exe PID 896 wrote to memory of 1632 896 vbc.exe vbc.exe PID 896 wrote to memory of 1632 896 vbc.exe vbc.exe PID 896 wrote to memory of 1632 896 vbc.exe vbc.exe PID 896 wrote to memory of 1632 896 vbc.exe vbc.exe PID 896 wrote to memory of 1632 896 vbc.exe vbc.exe PID 896 wrote to memory of 1632 896 vbc.exe vbc.exe PID 1264 wrote to memory of 1956 1264 Explorer.EXE NETSTAT.EXE PID 1264 wrote to memory of 1956 1264 Explorer.EXE NETSTAT.EXE PID 1264 wrote to memory of 1956 1264 Explorer.EXE NETSTAT.EXE PID 1264 wrote to memory of 1956 1264 Explorer.EXE NETSTAT.EXE PID 1956 wrote to memory of 1940 1956 NETSTAT.EXE cmd.exe PID 1956 wrote to memory of 1940 1956 NETSTAT.EXE cmd.exe PID 1956 wrote to memory of 1940 1956 NETSTAT.EXE cmd.exe PID 1956 wrote to memory of 1940 1956 NETSTAT.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\0403 Packing List.xls"2⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Public\vbc.exe"3⤵
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\40144C64.emfFilesize
95KB
MD53faf5b0096f65d1ce65fb3114dec4f0c
SHA1e829d253b20667c2bafae93ca1b986fd46590aa2
SHA25631e586b9894e034f731b0c2eeca358ced69dd25af1c5b35078560838cd306d62
SHA51205f345ad5984312d1313f56462165d6f4170cae47add7cd084d8cc1f184425c77a722d6efe110aa9446a744245d1ae53da371908fccd070d494d74840c99a6dd
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\CD3BB915.emfFilesize
1.4MB
MD5a01b9617553432807b9b58025b338d97
SHA1439bdcc450408b9735b2428c2d53d2e6977fa58c
SHA2567a0426ed2e2349916969ff7087c0f76089fb8ce7f4627f3d11ccbc1aaefcedce
SHA512312cc2563fa865d6a939fea85a520627c73ed9a95bafc98c89495f21d535dc658825be74b64f0f5c5815d1d234fc6e77a71779247e4973e39ba8dccec2f09bee
-
C:\Users\Public\vbc.exeFilesize
761KB
MD50d9b2efac64b4245292e7c3112ec8771
SHA161b32ec6303fd7fa890dadc3f3f18128f2c264c9
SHA2565dc52da7b97835654bab2a3a39e93d412a50608bfd7dfccb87ff716c9aba6a37
SHA51247d00d1a6e705662d18fb3a9885af5a8a51ad3ef4ad3bbbcabf544e5b9a959dc49be99fdea562ff6db59981941db91de761d7f3dbf59ccaaa12a9a35357081ed
-
C:\Users\Public\vbc.exeFilesize
761KB
MD50d9b2efac64b4245292e7c3112ec8771
SHA161b32ec6303fd7fa890dadc3f3f18128f2c264c9
SHA2565dc52da7b97835654bab2a3a39e93d412a50608bfd7dfccb87ff716c9aba6a37
SHA51247d00d1a6e705662d18fb3a9885af5a8a51ad3ef4ad3bbbcabf544e5b9a959dc49be99fdea562ff6db59981941db91de761d7f3dbf59ccaaa12a9a35357081ed
-
C:\Users\Public\vbc.exeFilesize
761KB
MD50d9b2efac64b4245292e7c3112ec8771
SHA161b32ec6303fd7fa890dadc3f3f18128f2c264c9
SHA2565dc52da7b97835654bab2a3a39e93d412a50608bfd7dfccb87ff716c9aba6a37
SHA51247d00d1a6e705662d18fb3a9885af5a8a51ad3ef4ad3bbbcabf544e5b9a959dc49be99fdea562ff6db59981941db91de761d7f3dbf59ccaaa12a9a35357081ed
-
C:\Users\Public\vbc.exeFilesize
761KB
MD50d9b2efac64b4245292e7c3112ec8771
SHA161b32ec6303fd7fa890dadc3f3f18128f2c264c9
SHA2565dc52da7b97835654bab2a3a39e93d412a50608bfd7dfccb87ff716c9aba6a37
SHA51247d00d1a6e705662d18fb3a9885af5a8a51ad3ef4ad3bbbcabf544e5b9a959dc49be99fdea562ff6db59981941db91de761d7f3dbf59ccaaa12a9a35357081ed
-
\Users\Public\vbc.exeFilesize
761KB
MD50d9b2efac64b4245292e7c3112ec8771
SHA161b32ec6303fd7fa890dadc3f3f18128f2c264c9
SHA2565dc52da7b97835654bab2a3a39e93d412a50608bfd7dfccb87ff716c9aba6a37
SHA51247d00d1a6e705662d18fb3a9885af5a8a51ad3ef4ad3bbbcabf544e5b9a959dc49be99fdea562ff6db59981941db91de761d7f3dbf59ccaaa12a9a35357081ed
-
memory/896-77-0x0000000005840000-0x00000000058F0000-memory.dmpFilesize
704KB
-
memory/896-69-0x0000000000480000-0x00000000004C0000-memory.dmpFilesize
256KB
-
memory/896-76-0x00000000004E0000-0x00000000004EC000-memory.dmpFilesize
48KB
-
memory/896-68-0x0000000001270000-0x0000000001334000-memory.dmpFilesize
784KB
-
memory/896-78-0x0000000000A30000-0x0000000000A38000-memory.dmpFilesize
32KB
-
memory/896-79-0x0000000000CD0000-0x0000000000D08000-memory.dmpFilesize
224KB
-
memory/896-74-0x0000000000540000-0x000000000055E000-memory.dmpFilesize
120KB
-
memory/896-75-0x0000000000480000-0x00000000004C0000-memory.dmpFilesize
256KB
-
memory/1060-107-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1060-54-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1264-89-0x0000000006C40000-0x0000000006D85000-memory.dmpFilesize
1.3MB
-
memory/1264-102-0x0000000006E30000-0x0000000006F71000-memory.dmpFilesize
1.3MB
-
memory/1264-99-0x0000000006E30000-0x0000000006F71000-memory.dmpFilesize
1.3MB
-
memory/1264-98-0x0000000006E30000-0x0000000006F71000-memory.dmpFilesize
1.3MB
-
memory/1632-83-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1632-87-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1632-88-0x00000000002A0000-0x00000000002B4000-memory.dmpFilesize
80KB
-
memory/1632-86-0x0000000000970000-0x0000000000C73000-memory.dmpFilesize
3.0MB
-
memory/1632-80-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1632-82-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1632-81-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1956-90-0x0000000000830000-0x0000000000839000-memory.dmpFilesize
36KB
-
memory/1956-91-0x0000000000830000-0x0000000000839000-memory.dmpFilesize
36KB
-
memory/1956-92-0x00000000000D0000-0x00000000000FF000-memory.dmpFilesize
188KB
-
memory/1956-93-0x00000000020A0000-0x00000000023A3000-memory.dmpFilesize
3.0MB
-
memory/1956-94-0x00000000000D0000-0x00000000000FF000-memory.dmpFilesize
188KB
-
memory/1956-97-0x0000000001F20000-0x0000000001FB3000-memory.dmpFilesize
588KB