Analysis
-
max time kernel
148s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
29-03-2023 18:51
Static task
static1
Behavioral task
behavioral1
Sample
April Orders.xls
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
April Orders.xls
Resource
win10v2004-20230221-en
General
-
Target
April Orders.xls
-
Size
1.0MB
-
MD5
625c489b71a4a7b7dc61dc3121368f02
-
SHA1
a36ef17d7c854bd238b6113148b8ec11f54286d7
-
SHA256
53f32eb1e2023b9346427d2111b0e4ac33ff4592384a1f0dae3dd5fc90dc4b2c
-
SHA512
93a0dd13791b1ab3db705c6f74ea820c120a95ae041a6186474c16b19fe1c6d44d0b9ef7a816a47f71c82847b5f7941af88eb1b964dba513fc89c9eb800e2240
-
SSDEEP
24576:lLKiSSMMednE8akAmmjmRakAmmjmw+MXUlHeA2222222222222222222222K2D0z:lLK2Mnaaoeaaoz+MX7TZVAw
Malware Config
Extracted
purecrypter
http://192.3.215.60/uo7/Cbqta.png
Extracted
formbook
4.1
ar73
classgorilla.com
b6817.com
1wwuwa.top
dgslimited.africa
deepwaterships.com
hkshshoptw.shop
hurricanevalleyatvjamboree.com
ckpconsulting.com
laojiangmath.com
authenticityhacking.com
family-doctor-53205.com
investinstgeorgeut.com
lithoearthsolution.africa
quickhealcareltd.co.uk
delightkgrillw.top
freezeclosettoilet.com
coo1star.com
gemgamut.com
enrichednetworksolutions.com
betterbeeclean.com
kbmstr.com
colorusainc.com
five-dollar-meals.com
baozhuang8.com
la-home-service.com
innovantexclusive.com
chateaudevillars.co.uk
echadholisticbar.com
naijacarprices.africa
4652.voto
kraftheonz.com
ingrambaby.com
braeunungsoel.ch
sweetcariadgifts.co.uk
kui693.com
akatov-top.ru
epollresearch.online
cupandsaucybooks.com
arredobagno.club
gt.sale
dskincare.com
cursosemcasa.site
leaf-spa.net
deathbeforedeceit.com
azvvs.com
laptops-39165.com
ccwt.vip
011965.com
mtevz.online
jacksontcpassettlement.com
aldeajerusalen.com
kellnovaglobalfood.info
alphametatek.online
lcssthh.com
dumelogold9ja.africa
d-storic.com
mogi.africa
ghostt.net
aksharsigns.online
goglucofort.com
b708.com
controlplus.systems
lightandstory.info
invstcai.sbs
2348x.com
Signatures
-
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Formbook payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1972-94-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1972-100-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1972-105-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/912-107-0x0000000000080000-0x00000000000AF000-memory.dmp formbook behavioral1/memory/912-109-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 3 776 EQNEDT32.EXE -
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
vbc.exepid process 836 vbc.exe -
Loads dropped DLL 4 IoCs
Processes:
EQNEDT32.EXEpid process 776 EQNEDT32.EXE 776 EQNEDT32.EXE 776 EQNEDT32.EXE 776 EQNEDT32.EXE -
Uses the VBS compiler for execution 1 TTPs
-
Drops file in System32 directory 1 IoCs
Processes:
powershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
vbc.exeMSBuild.exewlanext.exedescription pid process target process PID 836 set thread context of 1972 836 vbc.exe MSBuild.exe PID 1972 set thread context of 1196 1972 MSBuild.exe Explorer.EXE PID 1972 set thread context of 1196 1972 MSBuild.exe Explorer.EXE PID 912 set thread context of 1196 912 wlanext.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
EXCEL.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE -
Modifies registry class 64 IoCs
Processes:
EXCEL.EXEdescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32 EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1808 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
powershell.exeMSBuild.exewlanext.exepid process 1148 powershell.exe 1972 MSBuild.exe 1972 MSBuild.exe 1972 MSBuild.exe 912 wlanext.exe 912 wlanext.exe 912 wlanext.exe 912 wlanext.exe 912 wlanext.exe 912 wlanext.exe 912 wlanext.exe 912 wlanext.exe 912 wlanext.exe 912 wlanext.exe 912 wlanext.exe 912 wlanext.exe 912 wlanext.exe 912 wlanext.exe 912 wlanext.exe 912 wlanext.exe 912 wlanext.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
MSBuild.exewlanext.exepid process 1972 MSBuild.exe 1972 MSBuild.exe 1972 MSBuild.exe 1972 MSBuild.exe 912 wlanext.exe 912 wlanext.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
vbc.exepowershell.exeMSBuild.exewlanext.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 836 vbc.exe Token: SeDebugPrivilege 1148 powershell.exe Token: SeDebugPrivilege 1972 MSBuild.exe Token: SeDebugPrivilege 912 wlanext.exe Token: SeShutdownPrivilege 1196 Explorer.EXE Token: SeShutdownPrivilege 1196 Explorer.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1808 EXCEL.EXE 1808 EXCEL.EXE 1808 EXCEL.EXE -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
EQNEDT32.EXEvbc.exeMSBuild.exewlanext.exedescription pid process target process PID 776 wrote to memory of 836 776 EQNEDT32.EXE vbc.exe PID 776 wrote to memory of 836 776 EQNEDT32.EXE vbc.exe PID 776 wrote to memory of 836 776 EQNEDT32.EXE vbc.exe PID 776 wrote to memory of 836 776 EQNEDT32.EXE vbc.exe PID 776 wrote to memory of 836 776 EQNEDT32.EXE vbc.exe PID 776 wrote to memory of 836 776 EQNEDT32.EXE vbc.exe PID 776 wrote to memory of 836 776 EQNEDT32.EXE vbc.exe PID 836 wrote to memory of 1148 836 vbc.exe powershell.exe PID 836 wrote to memory of 1148 836 vbc.exe powershell.exe PID 836 wrote to memory of 1148 836 vbc.exe powershell.exe PID 836 wrote to memory of 1148 836 vbc.exe powershell.exe PID 836 wrote to memory of 1972 836 vbc.exe MSBuild.exe PID 836 wrote to memory of 1972 836 vbc.exe MSBuild.exe PID 836 wrote to memory of 1972 836 vbc.exe MSBuild.exe PID 836 wrote to memory of 1972 836 vbc.exe MSBuild.exe PID 836 wrote to memory of 1972 836 vbc.exe MSBuild.exe PID 836 wrote to memory of 1972 836 vbc.exe MSBuild.exe PID 836 wrote to memory of 1972 836 vbc.exe MSBuild.exe PID 1972 wrote to memory of 912 1972 MSBuild.exe wlanext.exe PID 1972 wrote to memory of 912 1972 MSBuild.exe wlanext.exe PID 1972 wrote to memory of 912 1972 MSBuild.exe wlanext.exe PID 1972 wrote to memory of 912 1972 MSBuild.exe wlanext.exe PID 912 wrote to memory of 544 912 wlanext.exe cmd.exe PID 912 wrote to memory of 544 912 wlanext.exe cmd.exe PID 912 wrote to memory of 544 912 wlanext.exe cmd.exe PID 912 wrote to memory of 544 912 wlanext.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\April Orders.xls"2⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"4⤵
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\8A02D1DF.emfFilesize
1.4MB
MD55c65827565e89d5357d6f81294701c19
SHA1600aa1899bdc58d12671774e84033366dc931c04
SHA256dec6f35ceb48260f3ba4e6487c48d3f97b274f2eff29cab00c2c7e677eef4b4f
SHA512052c177c606d30f4f3b658f60bb3643fffec498cc8fa931b4380aa6b93ac20fa9ef4600645740e99ba2f6d43e333fe783378d14395132819d6fb44787aad196a
-
C:\Users\Public\vbc.exeFilesize
88KB
MD5eebdd5b69b2fbe296a4e848b6ece83e7
SHA1a416b80860c5810aa92c72382eb34c29a36ad34a
SHA256dfb9a75bd82bcf0d9f72647affdf954d936d629eb3be78fe4b5c9b5166ccb9d6
SHA512b3d4a1cde995d12e16367fd0437a0fcd2bf52081aba40eace547e79838d17de40bb5162112132d3d1c49f7baf9a4c1581a8c4f696df64b4321c6f7cd27245afa
-
C:\Users\Public\vbc.exeFilesize
88KB
MD5eebdd5b69b2fbe296a4e848b6ece83e7
SHA1a416b80860c5810aa92c72382eb34c29a36ad34a
SHA256dfb9a75bd82bcf0d9f72647affdf954d936d629eb3be78fe4b5c9b5166ccb9d6
SHA512b3d4a1cde995d12e16367fd0437a0fcd2bf52081aba40eace547e79838d17de40bb5162112132d3d1c49f7baf9a4c1581a8c4f696df64b4321c6f7cd27245afa
-
C:\Users\Public\vbc.exeFilesize
88KB
MD5eebdd5b69b2fbe296a4e848b6ece83e7
SHA1a416b80860c5810aa92c72382eb34c29a36ad34a
SHA256dfb9a75bd82bcf0d9f72647affdf954d936d629eb3be78fe4b5c9b5166ccb9d6
SHA512b3d4a1cde995d12e16367fd0437a0fcd2bf52081aba40eace547e79838d17de40bb5162112132d3d1c49f7baf9a4c1581a8c4f696df64b4321c6f7cd27245afa
-
\Users\Public\vbc.exeFilesize
88KB
MD5eebdd5b69b2fbe296a4e848b6ece83e7
SHA1a416b80860c5810aa92c72382eb34c29a36ad34a
SHA256dfb9a75bd82bcf0d9f72647affdf954d936d629eb3be78fe4b5c9b5166ccb9d6
SHA512b3d4a1cde995d12e16367fd0437a0fcd2bf52081aba40eace547e79838d17de40bb5162112132d3d1c49f7baf9a4c1581a8c4f696df64b4321c6f7cd27245afa
-
\Users\Public\vbc.exeFilesize
88KB
MD5eebdd5b69b2fbe296a4e848b6ece83e7
SHA1a416b80860c5810aa92c72382eb34c29a36ad34a
SHA256dfb9a75bd82bcf0d9f72647affdf954d936d629eb3be78fe4b5c9b5166ccb9d6
SHA512b3d4a1cde995d12e16367fd0437a0fcd2bf52081aba40eace547e79838d17de40bb5162112132d3d1c49f7baf9a4c1581a8c4f696df64b4321c6f7cd27245afa
-
\Users\Public\vbc.exeFilesize
88KB
MD5eebdd5b69b2fbe296a4e848b6ece83e7
SHA1a416b80860c5810aa92c72382eb34c29a36ad34a
SHA256dfb9a75bd82bcf0d9f72647affdf954d936d629eb3be78fe4b5c9b5166ccb9d6
SHA512b3d4a1cde995d12e16367fd0437a0fcd2bf52081aba40eace547e79838d17de40bb5162112132d3d1c49f7baf9a4c1581a8c4f696df64b4321c6f7cd27245afa
-
\Users\Public\vbc.exeFilesize
88KB
MD5eebdd5b69b2fbe296a4e848b6ece83e7
SHA1a416b80860c5810aa92c72382eb34c29a36ad34a
SHA256dfb9a75bd82bcf0d9f72647affdf954d936d629eb3be78fe4b5c9b5166ccb9d6
SHA512b3d4a1cde995d12e16367fd0437a0fcd2bf52081aba40eace547e79838d17de40bb5162112132d3d1c49f7baf9a4c1581a8c4f696df64b4321c6f7cd27245afa
-
memory/836-78-0x0000000000020000-0x000000000003C000-memory.dmpFilesize
112KB
-
memory/836-79-0x0000000004CD0000-0x0000000004D10000-memory.dmpFilesize
256KB
-
memory/836-80-0x0000000005EE0000-0x0000000006062000-memory.dmpFilesize
1.5MB
-
memory/836-81-0x00000000056B0000-0x0000000005742000-memory.dmpFilesize
584KB
-
memory/836-86-0x0000000004CD0000-0x0000000004D10000-memory.dmpFilesize
256KB
-
memory/912-104-0x0000000000780000-0x0000000000796000-memory.dmpFilesize
88KB
-
memory/912-111-0x0000000001CD0000-0x0000000001D63000-memory.dmpFilesize
588KB
-
memory/912-106-0x0000000000780000-0x0000000000796000-memory.dmpFilesize
88KB
-
memory/912-108-0x0000000001E70000-0x0000000002173000-memory.dmpFilesize
3.0MB
-
memory/912-109-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/912-107-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/1148-84-0x0000000002010000-0x0000000002050000-memory.dmpFilesize
256KB
-
memory/1148-85-0x0000000002010000-0x0000000002050000-memory.dmpFilesize
256KB
-
memory/1148-89-0x0000000002010000-0x0000000002050000-memory.dmpFilesize
256KB
-
memory/1148-88-0x0000000002010000-0x0000000002050000-memory.dmpFilesize
256KB
-
memory/1148-87-0x0000000002010000-0x0000000002050000-memory.dmpFilesize
256KB
-
memory/1196-117-0x00000000066B0000-0x00000000067D4000-memory.dmpFilesize
1.1MB
-
memory/1196-114-0x00000000066B0000-0x00000000067D4000-memory.dmpFilesize
1.1MB
-
memory/1196-113-0x00000000066B0000-0x00000000067D4000-memory.dmpFilesize
1.1MB
-
memory/1196-99-0x0000000004C80000-0x0000000004D49000-memory.dmpFilesize
804KB
-
memory/1196-103-0x0000000004E10000-0x0000000004ED1000-memory.dmpFilesize
772KB
-
memory/1808-122-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1808-54-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1972-93-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmpFilesize
4KB
-
memory/1972-105-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1972-102-0x00000000001E0000-0x00000000001F4000-memory.dmpFilesize
80KB
-
memory/1972-100-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1972-98-0x0000000000140000-0x0000000000154000-memory.dmpFilesize
80KB
-
memory/1972-97-0x00000000008D0000-0x0000000000BD3000-memory.dmpFilesize
3.0MB
-
memory/1972-94-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1972-92-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1972-91-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB