agenttesla | a578c79ee5c97c543e2465e9740d3d827e61bddddbd9807a18a79c269e6cb37c

Analysis

max time kernel
102s
max time network
105s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
03-04-2023 11:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TTXSWIFTXCOPYXX37,000.00.docx
Size

10KB
MD5

b6be1d349682bfc62dbf86e68ab8ec4a
SHA1

98cbcf6d6d791f8520f8cf78629feac9e01d00fc
SHA256

a578c79ee5c97c543e2465e9740d3d827e61bddddbd9807a18a79c269e6cb37c
SHA512

e0b765f9bb90310ecefcf7f3ffad1f57d57dbbd58278d4001bff412a748e1152a31918a7ef7b443294f9472c0c4415073176f2000e29f6bb45abb03823d65ddf
SSDEEP

192:ScIMmtPGT7G/bIwXOVO995SEzBC4vNq6sM63lb8p:SPXuT+xXOVOBhlqHhw

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.mitcomicrons.com
Port:
587
Username:
tarif@mitcomicrons.com
Password:
mitco#123
Email To:
obtxxxtf@gmail.com

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Blocklisted process makes network request 1 IoCs

Processes:

EQNEDT32.EXE

flow pid process

7 1960 EQNEDT32.EXE
Downloads MZ/PE file

flow	pid	process
7	1960	EQNEDT32.EXE

Abuses OpenXML format to download file from external location 2 IoCs

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Office\14.0\Common	WINWORD.EXE
Key opened	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Office\Common\Offline\Files\http://3221468051/x......xx.......doc	WINWORD.EXE

Executes dropped EXE 2 IoCs

Processes:

vbc.exevbc.exe

pid process

1216 vbc.exe
1648 vbc.exe
Loads dropped DLL 2 IoCs

Processes:

EQNEDT32.EXE

pid process

1960 EQNEDT32.EXE
1960 EQNEDT32.EXE
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

pid	process
1216	vbc.exe
1648	vbc.exe

pid	process
1960	EQNEDT32.EXE
1960	EQNEDT32.EXE

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

vbc.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vbc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vbc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vbc.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

vbc.exe

description pid process target process

PID 1216 set thread context of 1648 1216 vbc.exe vbc.exe
Drops file in Windows directory 1 IoCs

Processes:

WINWORD.EXE

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1852 schtasks.exe
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
exploit

Exploitation for Client Execution
T1203

Processes:

EQNEDT32.EXE

pid process

1960 EQNEDT32.EXE

description	pid	process	target process
PID 1216 set thread context of 1648	1216	vbc.exe	vbc.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

pid	process
1852	schtasks.exe

pid	process
1960	EQNEDT32.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE

Modifies registry class 64 IoCs

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1304 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

vbc.exe

pid process

1216 vbc.exe
1216 vbc.exe
1216 vbc.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vbc.exevbc.exeWINWORD.EXE

description pid process

Token: SeDebugPrivilege 1216 vbc.exe
Token: SeDebugPrivilege 1648 vbc.exe
Token: SeShutdownPrivilege 1304 WINWORD.EXE
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

1304 WINWORD.EXE
1304 WINWORD.EXE

pid	process
1304	WINWORD.EXE

pid	process
1216	vbc.exe
1216	vbc.exe
1216	vbc.exe

description	pid	process
Token: SeDebugPrivilege	1216	vbc.exe
Token: SeDebugPrivilege	1648	vbc.exe
Token: SeShutdownPrivilege	1304	WINWORD.EXE

pid	process
1304	WINWORD.EXE
1304	WINWORD.EXE

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

EQNEDT32.EXEWINWORD.EXEvbc.exe

description	pid	process	target process
PID 1960 wrote to memory of 1216	1960	EQNEDT32.EXE	vbc.exe
PID 1960 wrote to memory of 1216	1960	EQNEDT32.EXE	vbc.exe
PID 1960 wrote to memory of 1216	1960	EQNEDT32.EXE	vbc.exe
PID 1960 wrote to memory of 1216	1960	EQNEDT32.EXE	vbc.exe
PID 1304 wrote to memory of 788	1304	WINWORD.EXE	splwow64.exe
PID 1304 wrote to memory of 788	1304	WINWORD.EXE	splwow64.exe
PID 1304 wrote to memory of 788	1304	WINWORD.EXE	splwow64.exe
PID 1304 wrote to memory of 788	1304	WINWORD.EXE	splwow64.exe
PID 1216 wrote to memory of 1852	1216	vbc.exe	schtasks.exe
PID 1216 wrote to memory of 1852	1216	vbc.exe	schtasks.exe
PID 1216 wrote to memory of 1852	1216	vbc.exe	schtasks.exe
PID 1216 wrote to memory of 1852	1216	vbc.exe	schtasks.exe
PID 1216 wrote to memory of 1648	1216	vbc.exe	vbc.exe
PID 1216 wrote to memory of 1648	1216	vbc.exe	vbc.exe
PID 1216 wrote to memory of 1648	1216	vbc.exe	vbc.exe
PID 1216 wrote to memory of 1648	1216	vbc.exe	vbc.exe
PID 1216 wrote to memory of 1648	1216	vbc.exe	vbc.exe
PID 1216 wrote to memory of 1648	1216	vbc.exe	vbc.exe
PID 1216 wrote to memory of 1648	1216	vbc.exe	vbc.exe
PID 1216 wrote to memory of 1648	1216	vbc.exe	vbc.exe
PID 1216 wrote to memory of 1648	1216	vbc.exe	vbc.exe

outlook_office_path 1 IoCs

Processes:

vbc.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vbc.exe

outlook_win_path 1 IoCs

Processes:

vbc.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vbc.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\TTXSWIFTXCOPYXX37,000.00.docx"
1⤵
- Abuses OpenXML format to download file from external location
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1304

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:788

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:1960

C:\Users\Public\vbc.exe
"C:\Users\Public\vbc.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1216

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AFUneNRXRS" /XML "C:\Users\Admin\AppData\Local\Temp\tmpED9A.tmp"
3⤵
- Creates scheduled task(s)
PID:1852

C:\Users\Public\vbc.exe
"{path}"
3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1648

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

T1064

Scheduled Task

T1053

Exploitation for Client Execution

T1203

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Scripting

T1064

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-CNRY.FSD
Filesize
128KB

MD5
d97adf3fd160ff08a694d0ae8d425e9e

SHA1
b756f4d7d0752a37ca4f52bea86a67473e1a0dde

SHA256
1066d18b61be2953230d3f295330a4674cf9e679328fb42a43a68a9951751bc0

SHA512
ac28614ae2db5f728b787bb55069f5d9bc72ff6c0daeca866b05cfffaefdcb94708eb4ba1702295e4db03f48cc9f9eca9dd9cee422f804d64212f11677f8911e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-{DC292FDA-5826-4A74-933F-E253BAA5BC7F}.FSD
Filesize
128KB

MD5
554390563bdb2d64b76d1040a7f8be74

SHA1
6149e677793cdb0933f7a4af1311d9a9a871aa96

SHA256
bd6ed7271dcb447599c3cf17331d78362b47d20aa076498dbf00ec384cb04049

SHA512
19279ca18ba69cacc917a34283016c671b8e1c08c38ebfa05412f2defc3edca15f5f04af35f331e00d4920cdababe317d96e62a33445578da7d60aeceec48a87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD
Filesize
128KB

MD5
7a6a9f493cea0f3402020b7db6750eca

SHA1
17e258535fed3c66f1d34361f1ff19ff4d74a410

SHA256
c89a767d5e81323d8c054faf266f576ab30baf17cb06b5d6b151877bfa79b94b

SHA512
125ec8234903b90dd2ae518027ef350aad8e422e599a89bc2a270827c927a301209e121b06b48d6e41594cde6a76e604d06f9562218b6b909614c1985afcf7fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-{3951321C-8E99-4559-B51A-DAFC9D154BC9}.FSD
Filesize
128KB

MD5
826f2e8eed1ba4440da08f128733ef55

SHA1
6b5292d043555976a876a6b893409890669e8d51

SHA256
7637519269987f548f2c1b5bad75875c9aa1e25f918a8d24f29c0471f84f26d2

SHA512
bbf91cf362732f2ebe1db9bab3d1d8974e9e61de06ae96ece2e0dc7c719491f11f337e33d6ddcd4bf3c75ce7d3d5e4a9b710fe417f9fd3b4baa701a42da55064

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\S7FIT0B8\x......xx[1].doc
Filesize
26KB

MD5
8a16ed1c07b77b743749e470b82bc2c7

SHA1
c5d8d11b75ee83418d464b343711dfbfb29f15ef

SHA256
5867d3ee084f07a5ba2bbd1ee94f8f40f89a3d497f36d4ba9ec3582db2d3b5de

SHA512
96db091ad8c696fb96c9ddad572a283b1b69f52345c2b707e8d8813eed3b7a0bc4dbe00e1c6a01cbeb37970b0b23d645c555599eb3f5c97f9e641391dc11743b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpED9A.tmp
Filesize
1KB

MD5
7e5893e73d3738fbc846a390c615163a

SHA1
96c03620e4257f5022be5f91624f85a3765b711d

SHA256
0f0ad7dbbe05f7f63bd032dae44ba9c9022bd6d58158b9ed217a18fa4b973acf

SHA512
490366dec37af9ec6298cf56ef4d8a236eaba62e3f76db6fe0efc26b4666e1a90a29ee547bb895d67b6a9ba49aafc5d448c145896f2802ac34632b7d7599bb35

Download Submit
C:\Users\Admin\AppData\Local\Temp\{FD51A2EF-7719-43B8-84F4-0DF7E8499976}
Filesize
128KB

MD5
389f58fa7366f2fee4183602b97125ea

SHA1
524bd89115de4841bb588059000f3a351c1f4293

SHA256
4faf05aae3af2777fcb0d8f69803481f4212ab995c69b95225673fb2c0836684

SHA512
8d6e2ec40f405908f44575aa6e85c15fed60b12dd3c0e58862841fcaf340f1e1e896d51c23461a29041a38b7331ac14c15f72e707585166e5c209c008b6348c6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
Filesize
20KB

MD5
60640ad100f1955b59dc85410d67665d

SHA1
b19ed94862fb3545658c169a7b9d47930abd971c

SHA256
01dc34ce01f754ddbb0a02e61992d0ffa782024eb45ffe8e5b83b7157049c103

SHA512
4ea6d974a7fb3cf8de0e04d957a1b4a2fc04730673b4a60b68c27a3c873715198c0a649b9ef6604a9646ddec055255567ac5498f9682a0702776fabac42232f8

Download Submit
C:\Users\Public\vbc.exe
Filesize
1.0MB

MD5
1d2e530be1bc9a98c41429524a89c79e

SHA1
bb11e3ba94fccdd21877c7180298c1df4f22d56b

SHA256
fb79bf743f1d8ec783dffc9e68d31bbe19d8f26954bea74ba81b7842ae36a820

SHA512
8ddcc3cbd113f6485ed6867489be2e1af0770e15b245fb5826248c6a6be5d230461e2dfbaab14d517588b781608591c73f7270ed5ebc684721aa2893e0670f37

Download Submit
C:\Users\Public\vbc.exe
Filesize
1.0MB

MD5
1d2e530be1bc9a98c41429524a89c79e

SHA1
bb11e3ba94fccdd21877c7180298c1df4f22d56b

SHA256
fb79bf743f1d8ec783dffc9e68d31bbe19d8f26954bea74ba81b7842ae36a820

SHA512
8ddcc3cbd113f6485ed6867489be2e1af0770e15b245fb5826248c6a6be5d230461e2dfbaab14d517588b781608591c73f7270ed5ebc684721aa2893e0670f37

Download Submit
C:\Users\Public\vbc.exe
Filesize
1.0MB

MD5
1d2e530be1bc9a98c41429524a89c79e

SHA1
bb11e3ba94fccdd21877c7180298c1df4f22d56b

SHA256
fb79bf743f1d8ec783dffc9e68d31bbe19d8f26954bea74ba81b7842ae36a820

SHA512
8ddcc3cbd113f6485ed6867489be2e1af0770e15b245fb5826248c6a6be5d230461e2dfbaab14d517588b781608591c73f7270ed5ebc684721aa2893e0670f37

Download Submit
C:\Users\Public\vbc.exe
Filesize
1.0MB

MD5
1d2e530be1bc9a98c41429524a89c79e

SHA1
bb11e3ba94fccdd21877c7180298c1df4f22d56b

SHA256
fb79bf743f1d8ec783dffc9e68d31bbe19d8f26954bea74ba81b7842ae36a820

SHA512
8ddcc3cbd113f6485ed6867489be2e1af0770e15b245fb5826248c6a6be5d230461e2dfbaab14d517588b781608591c73f7270ed5ebc684721aa2893e0670f37

Download Submit
\Users\Public\vbc.exe
Filesize
1.0MB

MD5
1d2e530be1bc9a98c41429524a89c79e

SHA1
bb11e3ba94fccdd21877c7180298c1df4f22d56b

SHA256
fb79bf743f1d8ec783dffc9e68d31bbe19d8f26954bea74ba81b7842ae36a820

SHA512
8ddcc3cbd113f6485ed6867489be2e1af0770e15b245fb5826248c6a6be5d230461e2dfbaab14d517588b781608591c73f7270ed5ebc684721aa2893e0670f37

Download Submit
\Users\Public\vbc.exe
Filesize
1.0MB

MD5
1d2e530be1bc9a98c41429524a89c79e

SHA1
bb11e3ba94fccdd21877c7180298c1df4f22d56b

SHA256
fb79bf743f1d8ec783dffc9e68d31bbe19d8f26954bea74ba81b7842ae36a820

SHA512
8ddcc3cbd113f6485ed6867489be2e1af0770e15b245fb5826248c6a6be5d230461e2dfbaab14d517588b781608591c73f7270ed5ebc684721aa2893e0670f37

Download Submit
memory/1216-154-0x0000000005500000-0x000000000557A000-memory.dmp

Filesize
488KB

Download
memory/1216-153-0x0000000004410000-0x0000000004450000-memory.dmp

Filesize
256KB

Download
memory/1216-155-0x0000000000AB0000-0x0000000000AE0000-memory.dmp

Filesize
192KB

Download
memory/1216-146-0x00000000004D0000-0x00000000004DC000-memory.dmp

Filesize
48KB

Download
memory/1216-144-0x0000000000C40000-0x0000000000D48000-memory.dmp

Filesize
1.0MB

Download
memory/1216-145-0x0000000004410000-0x0000000004450000-memory.dmp

Filesize
256KB

Download
memory/1304-54-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1304-198-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1648-164-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1648-161-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1648-163-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1648-162-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1648-169-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1648-167-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1648-170-0x0000000004DF0000-0x0000000004E30000-memory.dmp

Filesize
256KB

Download
memory/1648-171-0x0000000004DF0000-0x0000000004E30000-memory.dmp

Filesize
256KB

Download
memory/1648-160-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1648-159-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download