5c34c14865f4a98f6cc623710e445f479175aeafafcb55614b139fb61cff9de7

Resubmissions

04-08-2023 07:37

230804-jf93jaaa62 8

04-08-2023 07:10

230804-hzev3aba8v 8

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
04-08-2023 07:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

44e65a641fb970031c5efed324676b5018803e0a768608d3e186152102615795.xlsx
Size

2.1MB
MD5

c9ad9506bcccfaa987ff9fc11b91698d
SHA1

e788183a2a021f74a21f609e514bb63c4ef2fe49
SHA256

44e65a641fb970031c5efed324676b5018803e0a768608d3e186152102615795
SHA512

509c7c387810399b4a35371b1ae77733184299ee631f13b70e1582a9bed32c8eebaea79beb8ce7bf07ac8d3fcd7d09fd460a461266e073d6d2e6acc5e3bc68b2
SSDEEP

49152:hEK5fuBxYw1iHM+eP4yFIIFd52Mp21N5xb/CVBqCwj7IjLQc1U4l:SK5f6xYSl+VMy8G5ZC6CCIQc1/l

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

Processes:

EQNEDT32.EXE

flow pid process

5 2960 EQNEDT32.EXE
7 2960 EQNEDT32.EXE
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
exploit

Exploitation for Client Execution
T1203

Processes:

EQNEDT32.EXE

pid process

2960 EQNEDT32.EXE
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

2512 EXCEL.EXE
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

EXCEL.EXE

pid process

2512 EXCEL.EXE
2512 EXCEL.EXE
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

EXCEL.EXE

pid process

2512 EXCEL.EXE
2512 EXCEL.EXE
2512 EXCEL.EXE
2512 EXCEL.EXE

flow	pid	process
5	2960	EQNEDT32.EXE
7	2960	EQNEDT32.EXE

pid	process
2960	EQNEDT32.EXE

pid	process
2512	EXCEL.EXE

pid	process
2512	EXCEL.EXE
2512	EXCEL.EXE

pid	process
2512	EXCEL.EXE
2512	EXCEL.EXE
2512	EXCEL.EXE
2512	EXCEL.EXE

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\44e65a641fb970031c5efed324676b5018803e0a768608d3e186152102615795.xlsx
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2512

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
1⤵
- Blocklisted process makes network request
- Launches Equation Editor
PID:2960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Exploitation for Client Execution

T1203

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\vbc.exe

Filesize
297B

MD5
e2bdad32ee840a09f97430dafb4f882c

SHA1
bd39dae85f6517a66eacd6bec6cbc14b0bf5bb0b

SHA256
3b97adad5cc1d0cbb9ddf29e19782f61903bfcb706a9eaaeb8f4805d7e001b7b

SHA512
1f24b45452df5e1db4c8039b3a733b9db291a4abd504a9f34c1dc74c40ece9be00f8bbde0ef5be74cc9cefd0e64840e95bec8fe978c0c1da56bedf55ba616544

Download Submit
memory/2512-53-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2512-54-0x0000000073BCD000-0x0000000073BD8000-memory.dmp

Filesize
44KB

Download
memory/2512-65-0x0000000073BCD000-0x0000000073BD8000-memory.dmp

Filesize
44KB

Download
memory/2960-64-0x000000000A030000-0x000000000A031000-memory.dmp

Filesize
4KB

Download
memory/2960-66-0x000000000A030000-0x000000000A031000-memory.dmp

Filesize
4KB

Download