Overview
overview
10Static
static
8BuhtaClient.vbs
windows7-x64
1BuhtaClient.vbs
windows10-2004-x64
1BuhtaClient.exe
windows7-x64
10BuhtaClient.exe
windows10-2004-x64
10BuhtaDev.chm
windows7-x64
1BuhtaDev.chm
windows10-2004-x64
1BuhtaPivot.xls
windows7-x64
1BuhtaPivot.xls
windows10-2004-x64
1BuhtaServer.exe
windows7-x64
1BuhtaServer.exe
windows10-2004-x64
1PivotInstall.exe
windows7-x64
1PivotInstall.exe
windows10-2004-x64
1dsd.exe
windows7-x64
1dsd.exe
windows10-2004-x64
1eapi.dll
windows7-x64
3eapi.dll
windows10-2004-x64
3quricol32.dll
windows7-x64
1quricol32.dll
windows10-2004-x64
3Analysis
-
max time kernel
144s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
04-01-2024 00:15
Behavioral task
behavioral1
Sample
BuhtaClient.vbs
Resource
win7-20231129-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
BuhtaClient.vbs
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
BuhtaClient.exe
Resource
win7-20231215-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral4
Sample
BuhtaClient.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral5
Sample
BuhtaDev.chm
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
BuhtaDev.chm
Resource
win10v2004-20231215-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
BuhtaPivot.xls
Resource
win7-20231215-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral8
Sample
BuhtaPivot.xls
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
BuhtaServer.exe
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
BuhtaServer.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
PivotInstall.exe
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
PivotInstall.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
dsd.exe
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
dsd.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
eapi.dll
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral16
Sample
eapi.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral17
Sample
quricol32.dll
Resource
win7-20231215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral18
Sample
quricol32.dll
Resource
win10v2004-20231222-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
BuhtaPivot.xls
-
Size
59KB
-
MD5
8336b5a5ddf41cf813a1274a9543a34c
-
SHA1
533c18a7ce7db70dbc026b2f70031d44e6207c8d
-
SHA256
5596e8b493c644d62c9f6ab6f6a5d621ee2b348ef63d3270965b45021f308fe5
-
SHA512
e2f24c6c2d233b175053a41e382d3b1a29984c3bd28341bdaeadea977137717fb5df86ea27df57461cf6328155c00282ed569603c63940593fe4b33e196639f9
-
SSDEEP
768:To9kwJv744eN0WVkiPSx2o7piwJtNWVnBJIcXX3CWe5rMuh8tpd:8Owt744eN0WVJPSx2o7pi2ejAMuhc
Score
1/10
Malware Config
Signatures
-
Office loads VBA resources, possible macro or embedded object present
-
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ADDB372D-E53C-4249-A27E-BF3761CC71DC}\2.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VBE\\MSForms.exd" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}\ = "LabelControlEvents" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Wow6432Node\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389} EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BCF156FE-5169-4559-A2BA-A2F67BC0E973} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\TypeLib\{ADDB372D-E53C-4249-A27E-BF3761CC71DC} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Wow6432Node\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Interface\{47FF8FE8-6198-11CF-8CE8-00AA006CB389} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Wow6432Node\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}\ = "IMultiPage" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BCF156FE-5169-4559-A2BA-A2F67BC0E973} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Wow6432Node\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Wow6432Node\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Interface\{47FF8FE2-6198-11CF-8CE8-00AA006CB389} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Wow6432Node\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF}\ = "_UserForm" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Wow6432Node\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Interface\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents5" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Wow6432Node\Interface\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F}\ = "MultiPageEvents" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E0A30C39-543E-4FBC-8439-DB61BFAE320B} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Wow6432Node\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Interface\{8A683C91-BA84-11CF-8110-00A0C9030074} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcCombo" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Wow6432Node\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0} EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BCF156FE-5169-4559-A2BA-A2F67BC0E973}\ = "IEventSupportBMProEvents" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Wow6432Node\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Wow6432Node\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01}\ = "IOptionFrame" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Interface\{92E11A03-7358-11CE-80CB-00AA00611080} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Wow6432Node\Interface\{47FF8FE9-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents10" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{655F813B-DED0-4053-AB5C-2250F76AB966}\1.0\0 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E0A30C39-543E-4FBC-8439-DB61BFAE320B}\TypeLib\ = "{655F813B-DED0-4053-AB5C-2250F76AB966}" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Wow6432Node\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Wow6432Node\Interface\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLSubmitButton" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Wow6432Node\Interface\{47FF8FE4-6198-11CF-8CE8-00AA006CB389} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3} EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{655F813B-DED0-4053-AB5C-2250F76AB966}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\BuhtaClient.exe" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Wow6432Node\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074}\ = "IReturnString" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074}\ = "IReturnSingle" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Wow6432Node\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}\ = "Controls" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}\ = "FormEvents" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389} EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E0A30C39-543E-4FBC-8439-DB61BFAE320B}\TypeLib EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BCF156FE-5169-4559-A2BA-A2F67BC0E973}\TypeLib\Version = "1.0" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\TypeLib EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}\ = "ControlEvents" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Wow6432Node\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}\ = "IControl" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Wow6432Node\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcCheckBox" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLReset" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Wow6432Node\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLTextArea" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}\ = "TabStripEvents" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Wow6432Node\Interface\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents5" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{655F813B-DED0-4053-AB5C-2250F76AB966}\1.0\HELPDIR EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Wow6432Node\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}\ = "IScrollbar" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Interface\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}\ = "MdcCheckBoxEvents" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Interface\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}\ = "MdcOptionButtonEvents" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}\ = "MdcToggleButtonEvents" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Wow6432Node\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLCheckbox" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Wow6432Node\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Wow6432Node\Interface\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F} EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2296 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 2296 EXCEL.EXE 2296 EXCEL.EXE 2296 EXCEL.EXE 2296 EXCEL.EXE 2296 EXCEL.EXE 2296 EXCEL.EXE 2296 EXCEL.EXE
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\BuhtaPivot.xls1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2296