formbook | dc81b5b7a452a87fb69375b84afaeebd797411b314f5c8422dfa0d180226b354

General

Target

DHL Invoice JEDR001193478.xls
Size

1.3MB
MD5

fda7cc3767b509751d3c14700c9bbf66
SHA1

3f2a9ae3c98ab30f27a37e6515de4475471812f9
SHA256

dc81b5b7a452a87fb69375b84afaeebd797411b314f5c8422dfa0d180226b354
SHA512

b7476ae3fb8072cf33b2a0686febec558e5b40794c5a8d1462f6cefbacafd6170a177299840b2e02e1ae349ff068191c286333ddeb2ddac659d0c66ac2a5a7b2
SSDEEP

24576:ILKWSSMMednEhakAmmjmCakAmmjmt+MXUjakAmmjmT+MXUYP+222222222222228:ILKaMCaaoxaaoa+MXoaao4+MXC01tc

Score

10^/10

formbook ar73 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ar73

Decoy

classgorilla.com

b6817.com

1wwuwa.top

dgslimited.africa

deepwaterships.com

hkshshoptw.shop

hurricanevalleyatvjamboree.com

ckpconsulting.com

laojiangmath.com

authenticityhacking.com

family-doctor-53205.com

investinstgeorgeut.com

lithoearthsolution.africa

quickhealcareltd.co.uk

delightkgrillw.top

freezeclosettoilet.com

coo1star.com

gemgamut.com

enrichednetworksolutions.com

betterbeeclean.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 5 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1912-87-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1912-90-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1912-98-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral1/memory/1088-100-0x00000000001A0000-0x00000000001CF000-memory.dmp	formbook
behavioral1/memory/1088-102-0x00000000001A0000-0x00000000001CF000-memory.dmp	formbook

Blocklisted process makes network request 1 IoCs

Processes:

EQNEDT32.EXE

flow pid process

3 1688 EQNEDT32.EXE
Downloads MZ/PE file
Executes dropped EXE 1 IoCs

Processes:

vbc.exe

pid process

1096 vbc.exe
Loads dropped DLL 1 IoCs

Processes:

EQNEDT32.EXE

pid process

1688 EQNEDT32.EXE
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

flow	pid	process
3	1688	EQNEDT32.EXE

pid	process
1096	vbc.exe

pid	process
1688	EQNEDT32.EXE

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

vbc.exeMSBuild.execscript.exe

description	pid	process	target process
PID 1096 set thread context of 1912	1096	vbc.exe	MSBuild.exe
PID 1912 set thread context of 1248	1912	MSBuild.exe	Explorer.EXE
PID 1912 set thread context of 1248	1912	MSBuild.exe	Explorer.EXE
PID 1088 set thread context of 1248	1088	cscript.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

EXCEL.EXE

description ioc process

Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
exploit

Exploitation for Client Execution
T1203

Processes:

EQNEDT32.EXE

pid process

1688 EQNEDT32.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

pid	process
1688	EQNEDT32.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

EXCEL.EXE

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE

Modifies registry class 64 IoCs

Processes:

EXCEL.EXE

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1972 EXCEL.EXE

pid	process
1972	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 21 IoCs

Processes:

powershell.exeMSBuild.execscript.exe

pid	process
1092	powershell.exe
1912	MSBuild.exe
1912	MSBuild.exe
1912	MSBuild.exe
1088	cscript.exe
1088	cscript.exe
1088	cscript.exe
1088	cscript.exe
1088	cscript.exe
1088	cscript.exe
1088	cscript.exe
1088	cscript.exe
1088	cscript.exe
1088	cscript.exe
1088	cscript.exe
1088	cscript.exe
1088	cscript.exe
1088	cscript.exe
1088	cscript.exe
1088	cscript.exe
1088	cscript.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1248 Explorer.EXE
Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

MSBuild.execscript.exe

pid process

1912 MSBuild.exe
1912 MSBuild.exe
1912 MSBuild.exe
1912 MSBuild.exe
1088 cscript.exe
1088 cscript.exe

pid	process
1248	Explorer.EXE

pid	process
1912	MSBuild.exe
1912	MSBuild.exe
1912	MSBuild.exe
1912	MSBuild.exe
1088	cscript.exe
1088	cscript.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

vbc.exepowershell.exeMSBuild.execscript.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	1096	vbc.exe
Token: SeDebugPrivilege	1092	powershell.exe
Token: SeDebugPrivilege	1912	MSBuild.exe
Token: SeDebugPrivilege	1088	cscript.exe
Token: SeShutdownPrivilege	1248	Explorer.EXE
Token: SeShutdownPrivilege	1248	Explorer.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

EXCEL.EXE

pid process

1972 EXCEL.EXE
1972 EXCEL.EXE
1972 EXCEL.EXE

pid	process
1972	EXCEL.EXE
1972	EXCEL.EXE
1972	EXCEL.EXE

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

EQNEDT32.EXEvbc.exeExplorer.EXEcscript.exe

description	pid	process	target process
PID 1688 wrote to memory of 1096	1688	EQNEDT32.EXE	vbc.exe
PID 1688 wrote to memory of 1096	1688	EQNEDT32.EXE	vbc.exe
PID 1688 wrote to memory of 1096	1688	EQNEDT32.EXE	vbc.exe
PID 1688 wrote to memory of 1096	1688	EQNEDT32.EXE	vbc.exe
PID 1096 wrote to memory of 1092	1096	vbc.exe	powershell.exe
PID 1096 wrote to memory of 1092	1096	vbc.exe	powershell.exe
PID 1096 wrote to memory of 1092	1096	vbc.exe	powershell.exe
PID 1096 wrote to memory of 1092	1096	vbc.exe	powershell.exe
PID 1096 wrote to memory of 1912	1096	vbc.exe	MSBuild.exe
PID 1096 wrote to memory of 1912	1096	vbc.exe	MSBuild.exe
PID 1096 wrote to memory of 1912	1096	vbc.exe	MSBuild.exe
PID 1096 wrote to memory of 1912	1096	vbc.exe	MSBuild.exe
PID 1096 wrote to memory of 1912	1096	vbc.exe	MSBuild.exe
PID 1096 wrote to memory of 1912	1096	vbc.exe	MSBuild.exe
PID 1096 wrote to memory of 1912	1096	vbc.exe	MSBuild.exe
PID 1248 wrote to memory of 1088	1248	Explorer.EXE	cscript.exe
PID 1248 wrote to memory of 1088	1248	Explorer.EXE	cscript.exe
PID 1248 wrote to memory of 1088	1248	Explorer.EXE	cscript.exe
PID 1248 wrote to memory of 1088	1248	Explorer.EXE	cscript.exe
PID 1088 wrote to memory of 520	1088	cscript.exe	cmd.exe
PID 1088 wrote to memory of 520	1088	cscript.exe	cmd.exe
PID 1088 wrote to memory of 520	1088	cscript.exe	cmd.exe
PID 1088 wrote to memory of 520	1088	cscript.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1248

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\DHL Invoice JEDR001193478.xls"
2⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1972

C:\Windows\SysWOW64\cscript.exe
"C:\Windows\SysWOW64\cscript.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1088

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
3⤵
PID:520

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:1688

C:\Users\Public\vbc.exe
"C:\Users\Public\vbc.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1096

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==
3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1092

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1912

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Exploitation for Client Execution

1

T1203

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

2

T1082

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\A30F8926.emf
Filesize
1.4MB

MD5
5c65827565e89d5357d6f81294701c19

SHA1
600aa1899bdc58d12671774e84033366dc931c04

SHA256
dec6f35ceb48260f3ba4e6487c48d3f97b274f2eff29cab00c2c7e677eef4b4f

SHA512
052c177c606d30f4f3b658f60bb3643fffec498cc8fa931b4380aa6b93ac20fa9ef4600645740e99ba2f6d43e333fe783378d14395132819d6fb44787aad196a

Download Submit
C:\Users\Public\vbc.exe
Filesize
1.8MB

MD5
e4a076e7e4ef7dda7760195ed7e69a63

SHA1
01a916d1cb5acae7bcd2e8382d9a3691a2b90b39

SHA256
1da1d27f8c3f4188f1767f87ae85c14e1fda3fa80142af97697864580f1a2397

SHA512
8b23da6af698c2431bb7828291b5da97ba0f0bb87e7f51d623e083eb0e4b408fbb14725b043941ac1afee5dbae6d6c6d4d3780ecc17cd16ad4686b76a4797dbd

Download Submit
C:\Users\Public\vbc.exe
Filesize
1.8MB

MD5
e4a076e7e4ef7dda7760195ed7e69a63

SHA1
01a916d1cb5acae7bcd2e8382d9a3691a2b90b39

SHA256
1da1d27f8c3f4188f1767f87ae85c14e1fda3fa80142af97697864580f1a2397

SHA512
8b23da6af698c2431bb7828291b5da97ba0f0bb87e7f51d623e083eb0e4b408fbb14725b043941ac1afee5dbae6d6c6d4d3780ecc17cd16ad4686b76a4797dbd

Download Submit
C:\Users\Public\vbc.exe
Filesize
1.8MB

MD5
e4a076e7e4ef7dda7760195ed7e69a63

SHA1
01a916d1cb5acae7bcd2e8382d9a3691a2b90b39

SHA256
1da1d27f8c3f4188f1767f87ae85c14e1fda3fa80142af97697864580f1a2397

SHA512
8b23da6af698c2431bb7828291b5da97ba0f0bb87e7f51d623e083eb0e4b408fbb14725b043941ac1afee5dbae6d6c6d4d3780ecc17cd16ad4686b76a4797dbd

Download Submit
\Users\Public\vbc.exe
Filesize
1.8MB

MD5
e4a076e7e4ef7dda7760195ed7e69a63

SHA1
01a916d1cb5acae7bcd2e8382d9a3691a2b90b39

SHA256
1da1d27f8c3f4188f1767f87ae85c14e1fda3fa80142af97697864580f1a2397

SHA512
8b23da6af698c2431bb7828291b5da97ba0f0bb87e7f51d623e083eb0e4b408fbb14725b043941ac1afee5dbae6d6c6d4d3780ecc17cd16ad4686b76a4797dbd

Download Submit
memory/1088-97-0x0000000000050000-0x0000000000072000-memory.dmp

Filesize
136KB

Download
memory/1088-104-0x00000000021E0000-0x0000000002273000-memory.dmp

Filesize
588KB

Download
memory/1088-102-0x00000000001A0000-0x00000000001CF000-memory.dmp

Filesize
188KB

Download
memory/1088-101-0x0000000001ED0000-0x00000000021D3000-memory.dmp

Filesize
3.0MB

Download
memory/1088-100-0x00000000001A0000-0x00000000001CF000-memory.dmp

Filesize
188KB

Download
memory/1088-99-0x0000000000050000-0x0000000000072000-memory.dmp

Filesize
136KB

Download
memory/1092-77-0x00000000024E0000-0x0000000002520000-memory.dmp

Filesize
256KB

Download
memory/1092-80-0x00000000024E0000-0x0000000002520000-memory.dmp

Filesize
256KB

Download
memory/1092-81-0x00000000024E0000-0x0000000002520000-memory.dmp

Filesize
256KB

Download
memory/1092-82-0x00000000024E0000-0x0000000002520000-memory.dmp

Filesize
256KB

Download
memory/1092-78-0x00000000024E0000-0x0000000002520000-memory.dmp

Filesize
256KB

Download
memory/1096-71-0x0000000000C00000-0x0000000000DCA000-memory.dmp

Filesize
1.8MB

Download
memory/1096-72-0x00000000044B0000-0x00000000044F0000-memory.dmp

Filesize
256KB

Download
memory/1096-73-0x0000000006B10000-0x0000000006C76000-memory.dmp

Filesize
1.4MB

Download
memory/1096-74-0x00000000063A0000-0x0000000006432000-memory.dmp

Filesize
584KB

Download
memory/1096-79-0x00000000044B0000-0x00000000044F0000-memory.dmp

Filesize
256KB

Download
memory/1248-96-0x0000000007290000-0x0000000007402000-memory.dmp

Filesize
1.4MB

Download
memory/1248-92-0x0000000006A00000-0x0000000006B81000-memory.dmp

Filesize
1.5MB

Download
memory/1248-109-0x0000000007560000-0x0000000007681000-memory.dmp

Filesize
1.1MB

Download
memory/1248-107-0x0000000007560000-0x0000000007681000-memory.dmp

Filesize
1.1MB

Download
memory/1248-106-0x0000000007560000-0x0000000007681000-memory.dmp

Filesize
1.1MB

Download
memory/1912-85-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1912-89-0x0000000000990000-0x0000000000C93000-memory.dmp

Filesize
3.0MB

Download
memory/1912-87-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1912-86-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1912-90-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1912-98-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1912-91-0x0000000000190000-0x00000000001A4000-memory.dmp

Filesize
80KB

Download
memory/1912-95-0x00000000001D0000-0x00000000001E4000-memory.dmp

Filesize
80KB

Download
memory/1912-84-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1972-54-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1972-114-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads