agenttesla | 8402999484537d7b6a3ab9f2d1dc95aa667e35e13aad7b1ff4cf9f8622144848

Analysis

max time kernel
144s
max time network
144s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
01/05/2024, 14:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ET2431000075 & ET2431000076.xls
Size 239KB
Sample240501-rraqtaba37
SHA256 8402999484537d7b6a3ab9f2d1dc95aa667e35e13aad7b1ff4cf9f8622144848
MD5 9cabb136d3bfdc370eb1588551c14458
SHA1 08ea15340a2f9fb17bb63249818f96854197ae8c
SHA512 4f0287fedfd6905901b1f0c7e7ca280ec1b57481057c2e2684ea578f285bedaa5d8041507ceb298e04af3b4f8d8158ef39c16a441b62583f41d93a766937c89d
SSDEEP 6144:fd4UcLe0JOqPQZR8MDdATCR3tSv0W8+joKfpFlfQHus:yUP/qPQZR8MxAm/S8W8m/ff
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
sg2plcpnl0128.prod.sin2.secureserver.net
Port
587
Username
[email protected]
Password
oc27-JcbRAO~
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Blocklisted process makes network request 1 IoCs

flow	pid	Process
11	1672	EQNEDT32.EXE

Downloads MZ/PE file
Abuses OpenXML format to download file from external location

Executes dropped EXE 1 IoCs

pid	Process
2284	hkc.exe

Loads dropped DLL 2 IoCs

pid	Process
1672	EQNEDT32.EXE
1672	EQNEDT32.EXE

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
12	api.ipify.org
13	api.ipify.org

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2284 set thread context of 1872	2284	hkc.exe	42

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2412	schtasks.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Launches Equation Editor 1 TTPs 1 IoCs

Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

exploit

Exploitation for Client Execution

T1203

pid	Process
1672	EQNEDT32.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1948	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2284	hkc.exe
2284	hkc.exe
1872	RegSvcs.exe
1872	RegSvcs.exe
296	powershell.exe
408	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2284	hkc.exe
Token: SeDebugPrivilege	1872	RegSvcs.exe
Token: SeDebugPrivilege	296	powershell.exe
Token: SeDebugPrivilege	408	powershell.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1948	EXCEL.EXE
1948	EXCEL.EXE
1948	EXCEL.EXE
2696	WINWORD.EXE
2696	WINWORD.EXE

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 2284	1672	EQNEDT32.EXE	33
PID 1672 wrote to memory of 2284	1672	EQNEDT32.EXE	33
PID 1672 wrote to memory of 2284	1672	EQNEDT32.EXE	33
PID 1672 wrote to memory of 2284	1672	EQNEDT32.EXE	33
PID 2696 wrote to memory of 2132	2696	WINWORD.EXE	34
PID 2696 wrote to memory of 2132	2696	WINWORD.EXE	34
PID 2696 wrote to memory of 2132	2696	WINWORD.EXE	34
PID 2696 wrote to memory of 2132	2696	WINWORD.EXE	34
PID 2284 wrote to memory of 296	2284	hkc.exe	36
PID 2284 wrote to memory of 296	2284	hkc.exe	36
PID 2284 wrote to memory of 296	2284	hkc.exe	36
PID 2284 wrote to memory of 296	2284	hkc.exe	36
PID 2284 wrote to memory of 408	2284	hkc.exe	38
PID 2284 wrote to memory of 408	2284	hkc.exe	38
PID 2284 wrote to memory of 408	2284	hkc.exe	38
PID 2284 wrote to memory of 408	2284	hkc.exe	38
PID 2284 wrote to memory of 2412	2284	hkc.exe	40
PID 2284 wrote to memory of 2412	2284	hkc.exe	40
PID 2284 wrote to memory of 2412	2284	hkc.exe	40
PID 2284 wrote to memory of 2412	2284	hkc.exe	40
PID 2284 wrote to memory of 1872	2284	hkc.exe	42
PID 2284 wrote to memory of 1872	2284	hkc.exe	42
PID 2284 wrote to memory of 1872	2284	hkc.exe	42
PID 2284 wrote to memory of 1872	2284	hkc.exe	42
PID 2284 wrote to memory of 1872	2284	hkc.exe	42
PID 2284 wrote to memory of 1872	2284	hkc.exe	42
PID 2284 wrote to memory of 1872	2284	hkc.exe	42
PID 2284 wrote to memory of 1872	2284	hkc.exe	42
PID 2284 wrote to memory of 1872	2284	hkc.exe	42
PID 2284 wrote to memory of 1872	2284	hkc.exe	42
PID 2284 wrote to memory of 1872	2284	hkc.exe	42
PID 2284 wrote to memory of 1872	2284	hkc.exe	42

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\ET2431000075 & ET2431000076.xls"
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1948

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2132

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Users\Admin\AppData\Roaming\hkc.exe
  "C:\Users\Admin\AppData\Roaming\hkc.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2284
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\hkc.exe"
    3⤵
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:296
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\TDUOdzDXjTezF.exe"
    3⤵
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:408
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TDUOdzDXjTezF" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB07B.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:2412
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Exploitation for Client Execution

T1203

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FSD-CNRY.FSD

Path C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-CNRY.FSD
Size 128KB
SHA256 4d518cdf0f10fab265c2fc3ec8e3805ae462cc217ab11097f7335fd3531324a0
MD5 a970d653d7f38f1c5ea570b4b5c455d5
SHA1 6b9e28e327d7793ad1c77b65c42308ec5130a9c9
SHA512 299ca27c23b47ab6efc22d367b23136fcd55a39cbf7f83985ef75329fbbeeb6e3b9eec039ec7e47537ce5be49cc8b0fa3c6484339c829194c0ecea685cc628ef
SSDEEP 48:I3KLipRkwBi5BbVhSVnsumsYOuKMGUhrPOJOTH:KKLipTu85oKMGU9mYTH
MD5 SHA1 SHA512 SSDEEP

Submit Download

FSD-{C740F889-36FF-4E32-9D5F-683EF930A30B}.FSD

Path C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-{C740F889-36FF-4E32-9D5F-683EF930A30B}.FSD
Size 128KB
SHA256 d2d75583bcc51dfb7a1c26b936a5b421b2a854cf54aab0c850a8e24715ae4b23
MD5 98a1397148bdbc1210c2ecba9270704d
SHA1 5f8bbd708f0398be53443091c7e65ada87873598
SHA512 6c68131ce46b0213e56eaa24c41f3e23d405a15c7cda00d4bbee6eb24d9ed9eba4016407aa471320467a3e6c2d15204a6e356417619c6f6e78c298db32ea181a
SSDEEP 96:KcVyOrWxDaadtTGGU6P6DoGO0tZya6tpFya6tp7:jrWxmwtTGGU6P6EGHP6tP6
MD5 SHA1 SHA512 SSDEEP

Submit Download

FSD-CNRY.FSD

Path C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD
Size 128KB
SHA256 4dc8ff9a4a536f4647ef5aac278b25ffd6b4d1bf9808b8f8ca68ed1d53cc34e6
MD5 320aee7ea923543bc823ce98ae5f698b
SHA1 a8233c08d270b060e094721523a87429473c3c28
SHA512 e5e9e2a2e7e800599d8165c6379cf9aedf797add64a42e42c9ecf4f46ec7c211760a8406b4ebd17e30c74b4220c51970b70d3f282ea61b998c1ace5823fd2ef9
SSDEEP 48:I3xZHPQkwBFf8FMi4O0ncFjew5/G/nc7PuR1nGdUCGrzr63BIKt/YBIKt/SH:KxZHIyebRuWrnGUp6xIKEIKEH
MD5 SHA1 SHA512 SSDEEP

Submit Download

FSD-{6B744373-56E1-4A62-835B-31EEE656F2CB}.FSD

Path C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-{6B744373-56E1-4A62-835B-31EEE656F2CB}.FSD
Size 128KB
SHA256 8f314387dff188531eb5d555cdec1d9cf739b1013d419297eb8ac0d15381ff78
MD5 74e52a9f345d35eb722eee85559ca3f0
SHA1 9af797e2eddb33324ba12108adbb3353f5957216
SHA512 00bb1e590c8e20fb5e876ba8dcc5d6af5162728dbffecccc20b6b6a121fbbecf5c5b70dea971d198570b598da6a7057083ca55e8d6962b5e76e45bdce83fbaba
SSDEEP 24:I3jUkCwnM0B34+knJV2YjZPM1M2LZhW0sXYK23j0befXWlEX4LEB/w+spatZpatS:I3jUkHrBQ3lMzI4usWlEoLgY+pE0
MD5 SHA1 SHA512 SSDEEP

Submit Download

creatednewthingstounderstandhowgoodfishingdowithaboatwenotunderstandthatgirl___beautifulgirlkissedmelove[1].doc

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I819HQXH\creatednewthingstounderstandhowgoodfishingdowithaboatwenotunderstandthatgirl___beautifulgirlkissedmelove[1].doc
Size 74KB
SHA256 cd8edf6fd58e1aab115d9da94f4e8427c29b430cbac0dc9f01f9442c37a5cd7e
MD5 584c735262a9081e8936430d1e631f01
SHA1 d4ff3d3d6aafa8c7537be9746266daaad5a50fca
SHA512 988d11aba4a60011d2f7ab0b7966c91fb377a88a82378a97599dfaf55ee8e48c91e2e5ba3573974b5870aebe9ae22cc5e13b0355f7d7a6777828b531e15ca711
SSDEEP 1536:vEIzYbFcANQv8Af88gjoUo9sQW9mtNnfCKIEvEySWhVwOF2JFWv/UUjRWHafPPTV:v0bmAI3gjoUP0CTE8pOFEFGMUjRWHafB
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpB07B.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpB07B.tmp
Size 1KB
SHA256 2d814c5bd8ba62b0c8a15dd4d800251be65f90032f6ee9f716d040645b1eb72c
MD5 a47e227fa7c0968b7801551f7d783622
SHA1 3498168805596979ebc931e9cdca8f7bc8c8838d
SHA512 6cfc3c14e269eccc10e5ac6049a3fea7e4759d10da5447ada21831d1d2589684ebe2e0f2226455a8fe8862be571e7f0e3e09c6fc4890551de8c9c11bc87a7f5f
MD5 SHA1 SHA512

Submit Download

{1D511449-AA21-46B0-8CB4-1628E5EA7A51}

Path C:\Users\Admin\AppData\Local\Temp\{1D511449-AA21-46B0-8CB4-1628E5EA7A51}
Size 128KB
SHA256 7b4c777a5fc5cf53f48b0f4a1fc145fcd8820996ab2250b46f7e9366cab5387d
MD5 f1a47b93c503cf6413a34fc3359be3e5
SHA1 75e918e5d113fec28be6eb5e642f689fa30e8495
SHA512 7052fbe8834add567308ab045809bdc96312c096df73506ab0adc7d600e99dda15197535ebb330aa1746e81be8301d28dc335a4858658a89ea19c4928edcf716
SSDEEP 6:I3DPcyqCVvxggLRtSQ/J7UF3GTbtRX/xQxQsfnRujlw//+GtluJ/eRuj:I3DPmc4Q6FSbT5k7g3J/
MD5 SHA1 SHA512 SSDEEP

Submit Download

d93f411851d7c929.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Size 7KB
SHA256 096e2c97178b1d4e3abce0455df679196e9c59307239dc1585657273c28c83df
MD5 a9265dd0259b90939f20efa959d43ec3
SHA1 9436293dac8c18ce85ae20fc57c5e95bda696907
SHA512 e0bd43780bb526b90e905b9665afcd3e4f81b3f30a3615975a3d387613d5428108fa28b40fec6bb7cd2259959e8ffdc023f6e8ea626791c487438d821bc82666
SSDEEP 96:led0PCBM8AnqvsqvJCwoied0PCBM8AnqvsEHyqvJCworqPVkwsQHlzHEz7RP9XlD:800cUol00cAHnorqPuYzkz7RP9x
MD5 SHA1 SHA512 SSDEEP

Submit Download

hkc.exe

Path \Users\Admin\AppData\Roaming\hkc.exe
Size 791KB
SHA256 94e86d7455f9c08cc57d6706e0f779a59459fbdac1506d5b12f20566ad2b9cce
MD5 e908276b036728bc78a3dea637580af2
SHA1 38a1c2e000c8eb53c7e050017bfed76826c2b062
SHA512 b82e42337655aa8d44c7503525b53cb351261f1459b5d2c7b8c4084a5d2b66c8c24a759e54135378cebe0808d502415eeeef9e14977090aa47ee90eeec3fe0d4
SSDEEP 24576:VpqVLMtl3AzPwkEGMVx+sNjaEuXZZThqnbcjX9:Teot5Az4kEGMVx+sd6ZphqEX
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1872-118-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1872-120-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1872-122-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1872-124-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1872-126-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/1872-127-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1872-130-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1872-128-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1948-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

Download

memory/1948-1-0x00000000728FD000-0x0000000072908000-memory.dmp

Download

memory/1948-8-0x0000000002CD0000-0x0000000002CD2000-memory.dmp

Download

memory/1948-77-0x00000000728FD000-0x0000000072908000-memory.dmp

Download

memory/2284-105-0x00000000077E0000-0x0000000007862000-memory.dmp

Download

memory/2284-104-0x0000000000280000-0x0000000000296000-memory.dmp

Download

memory/2284-103-0x0000000000210000-0x0000000000226000-memory.dmp

Download

memory/2284-101-0x0000000000B90000-0x0000000000C5C000-memory.dmp

Download

memory/2696-3-0x000000002FAB1000-0x000000002FAB2000-memory.dmp

Download

memory/2696-78-0x00000000728FD000-0x0000000072908000-memory.dmp

Download

memory/2696-5-0x00000000728FD000-0x0000000072908000-memory.dmp

Download

memory/2696-7-0x00000000036D0000-0x00000000036D2000-memory.dmp

Download