Malware Analysis Report

2024-12-07 22:46

Sample ID 240514-cbjlfsee4t
Target Order2354.xls
SHA256 114ea93681433aaf40289d58407cb4b570748645aca682ddae3052b6f428b3f7
Tags
remcos execution rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

114ea93681433aaf40289d58407cb4b570748645aca682ddae3052b6f428b3f7

Threat Level: Known bad

The file Order2354.xls was found to be: Known bad.

Malicious Activity Summary

remcos execution rat

Remcos

Downloads MZ/PE file

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Abuses OpenXML format to download file from external location

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

Drops file in System32 directory

Program crash

Enumerates physical storage devices

Office loads VBA resources, possible macro or embedded object present

Uses Volume Shadow Copy WMI provider

Suspicious use of WriteProcessMemory

Checks processor information in registry

Creates scheduled task(s)

Launches Equation Editor

Modifies Internet Explorer settings

Suspicious use of AdjustPrivilegeToken

Uses Volume Shadow Copy service COM API

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Modifies registry class

Enumerates system info in registry

Suspicious behavior: AddClipboardFormatListener

Uses Task Scheduler COM API

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-14 01:54

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-14 01:54

Reported

2024-05-14 01:57

Platform

win7-20240221-en

Max time kernel

148s

Max time network

163s

Command Line

"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\Order2354.xls

Signatures

Remcos

rat remcos

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Downloads MZ/PE file

Abuses OpenXML format to download file from external location

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\vnc.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\vnc.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\vnc.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1208 set thread context of 696 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Users\Admin\AppData\Roaming\vnc.exe

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\vnc.exe

Office loads VBA resources, possible macro or embedded object present

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Launches Equation Editor

exploit
Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Modifies registry class

Description Indicator Process Target
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\vnc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 352 wrote to memory of 1208 N/A C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE C:\Users\Admin\AppData\Roaming\vnc.exe
PID 352 wrote to memory of 1208 N/A C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE C:\Users\Admin\AppData\Roaming\vnc.exe
PID 352 wrote to memory of 1208 N/A C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE C:\Users\Admin\AppData\Roaming\vnc.exe
PID 352 wrote to memory of 1208 N/A C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE C:\Users\Admin\AppData\Roaming\vnc.exe
PID 2444 wrote to memory of 2252 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2444 wrote to memory of 2252 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2444 wrote to memory of 2252 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2444 wrote to memory of 2252 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 1208 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1208 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1208 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1208 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1208 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1208 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1208 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1208 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1208 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Windows\SysWOW64\schtasks.exe
PID 1208 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Windows\SysWOW64\schtasks.exe
PID 1208 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Windows\SysWOW64\schtasks.exe
PID 1208 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Windows\SysWOW64\schtasks.exe
PID 1208 wrote to memory of 644 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Users\Admin\AppData\Roaming\vnc.exe
PID 1208 wrote to memory of 644 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Users\Admin\AppData\Roaming\vnc.exe
PID 1208 wrote to memory of 644 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Users\Admin\AppData\Roaming\vnc.exe
PID 1208 wrote to memory of 644 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Users\Admin\AppData\Roaming\vnc.exe
PID 1208 wrote to memory of 696 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Users\Admin\AppData\Roaming\vnc.exe
PID 1208 wrote to memory of 696 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Users\Admin\AppData\Roaming\vnc.exe
PID 1208 wrote to memory of 696 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Users\Admin\AppData\Roaming\vnc.exe
PID 1208 wrote to memory of 696 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Users\Admin\AppData\Roaming\vnc.exe
PID 1208 wrote to memory of 696 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Users\Admin\AppData\Roaming\vnc.exe
PID 1208 wrote to memory of 696 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Users\Admin\AppData\Roaming\vnc.exe
PID 1208 wrote to memory of 696 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Users\Admin\AppData\Roaming\vnc.exe
PID 1208 wrote to memory of 696 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Users\Admin\AppData\Roaming\vnc.exe
PID 1208 wrote to memory of 696 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Users\Admin\AppData\Roaming\vnc.exe
PID 1208 wrote to memory of 696 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Users\Admin\AppData\Roaming\vnc.exe
PID 1208 wrote to memory of 696 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Users\Admin\AppData\Roaming\vnc.exe
PID 1208 wrote to memory of 696 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Users\Admin\AppData\Roaming\vnc.exe
PID 1208 wrote to memory of 696 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Users\Admin\AppData\Roaming\vnc.exe
PID 696 wrote to memory of 1504 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Windows\SysWOW64\WerFault.exe
PID 696 wrote to memory of 1504 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Windows\SysWOW64\WerFault.exe
PID 696 wrote to memory of 1504 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Windows\SysWOW64\WerFault.exe
PID 696 wrote to memory of 1504 N/A C:\Users\Admin\AppData\Roaming\vnc.exe C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\Order2354.xls

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" -Embedding

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding

C:\Users\Admin\AppData\Roaming\vnc.exe

"C:\Users\Admin\AppData\Roaming\vnc.exe"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vnc.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\jGiHPUkzfFmtq.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jGiHPUkzfFmtq" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB1F1.tmp"

C:\Users\Admin\AppData\Roaming\vnc.exe

"C:\Users\Admin\AppData\Roaming\vnc.exe"

C:\Users\Admin\AppData\Roaming\vnc.exe

"C:\Users\Admin\AppData\Roaming\vnc.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 696 -s 200

Network

Country Destination Domain Proto
US 8.8.8.8:53 dokdo.in udp
US 188.114.97.2:80 dokdo.in tcp
US 188.114.97.2:443 dokdo.in tcp
US 172.93.222.102:80 172.93.222.102 tcp
US 188.114.97.2:80 dokdo.in tcp
US 188.114.97.2:80 dokdo.in tcp
US 188.114.97.2:80 dokdo.in tcp
US 188.114.97.2:80 dokdo.in tcp
US 188.114.97.2:443 dokdo.in tcp
US 188.114.97.2:80 dokdo.in tcp
US 188.114.97.2:443 dokdo.in tcp
US 172.93.222.102:80 172.93.222.102 tcp
US 172.93.222.102:80 172.93.222.102 tcp

Files

memory/1464-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/1464-1-0x00000000724DD000-0x00000000724E8000-memory.dmp

memory/2444-20-0x000000002FD31000-0x000000002FD32000-memory.dmp

memory/2444-22-0x00000000724DD000-0x00000000724E8000-memory.dmp

memory/2444-24-0x0000000003710000-0x0000000003712000-memory.dmp

memory/1464-25-0x0000000002440000-0x0000000002442000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\ZPTO8L6F.txt

MD5 5c28095465c506cbc06566bbdbf01928
SHA1 a70792d71ef0f630f7aee408e01ebbef6526c139
SHA256 133bf29ae103dde004de5f0b4f99e736c62f48ac0da7deb205e777c12a5ed6e8
SHA512 cf6c2c82a95bfd1d35502b37cef5dd1d0bed37f63edb165627b2f48c9e7b75fe0e6c3992ba6ca66d721626fa28c09080697046e90bb95b0be64df3e1383dcbf5

C:\Users\Admin\AppData\Local\Temp\{9E9AA1BC-AB92-44E7-A6B5-1488ED93B0B9}

MD5 6a4b7405b5c97e82c0e31bbd861de6f7
SHA1 47681e57138328c79c288108c8494cda5c7a85d9
SHA256 499656d6bfa010a17764051b7c72b75fc36d5d63c3c8e20d5e7ec02937d1ef54
SHA512 b147404c89eab6bc43e43c80380e91bbf2095fe6d45968af01fbb5b3e70f6fc9ac8aa8f56a29fbf71c2153f50948c8b14effbe80962479fecbe5484c1081f213

C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-{2B5C5F24-18D5-463F-A792-9FB5D2CC9BF0}.FSD

MD5 df37dc9fd749f9c8cc4b3d836bc75473
SHA1 c78259062a4c2908a925d3e9e797297dddd3e153
SHA256 6b9e5d99e827b05220a422c01e9341dbcc7c0e424ee8e6ae18b1d6fa1f8fda18
SHA512 99d945f8c8da8487f907a3026f3aef45a73eced262f82451f5a0b6d61d53f24b3da8bb44be112475f118e74f923e586dababc1dc6a9dd6e9065ed6cb37940048

C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD

MD5 282970f2796ceeab6c66c40d983307b4
SHA1 6d9588de9acc9eff8af0e312153d170f34309c8e
SHA256 9b9e07ae903d3b8e8b8f5482f930c84480dcd6c6758d8fada521dd1b9fb427b8
SHA512 1f510d612737aa9a44a9d70049ab9b68b09e3753e5b693b3e3bcf351afdb71561590d34a58c8d96e78011014386d71db65efcd9d1dd8947a82d9722ff7c18c65

C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-{6EECC347-7DF1-4D19-B370-436AA9BA4481}.FSD

MD5 e0b7125a25fb1558c9d1e45334e04687
SHA1 de52a7095be7070afcdcf29a0c91c76a9644d402
SHA256 da6d29914e9ae43d08a5c125d9995beb7a75c1a22ee178c08f6300ff89e783dd
SHA512 e480da4e542677edbfe30855720d291e8e0fb2f9a6f76aea102e14d7fff9b1e5ea79342e0ee028add893f7b7963bc20d27358b013fbf70faea9231544669431d

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OORQXHVT\beautifulroseflowerwanttogetinhandbecauseitsgreatthingshandbeautiuflthingshappenedtogetback___beautiuflflowers[1].doc

MD5 7a7b11bbe3d337c74805c519c22601c0
SHA1 4b680f33a5d1f26934429bb7dff11b8b3f6ea0f8
SHA256 3f6bd3440b27d64b41ff2902d7b35c1105b7dc026e834755a1b44f63b5da965e
SHA512 c637d681ff8f7e00c74291bf38835ada5d4c074d62f9d5a12ceed7b4ec540f21e05dc89469664af08d7a68040e5d0646e1f13669ddec965812ce9eeb78975302

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 e911d5250fd2c67530801b2c146e56ad
SHA1 c5452baaee6e85d4129c0f35f5d4182fa3b225f8
SHA256 c27edf2fc78bb8ea82d5bca8f2aa9a6ba9a7a62f8e75c9f1af92dec7bfcb229d
SHA512 0eb3e6a4bffe7eca9f3c62e89c71f92b2e4527cd240cfd0743a5abf492e44f7c22128c402c02b34177f34ae83f06fa24cf22fbabab58ecc4fc4935e342f56b1d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 91911ffde48664c6a8a558a3e1643d8d
SHA1 a170335cd76fb9d221381b8bb268edf998799fe5
SHA256 cc48b198fe6d4b3eaff64b31039107d213d1fc29f8d232e48ff89c4d91e120b6
SHA512 65a79fd137d98ff1391b403c9c4de2628c644c7e215def1f5a0f098fbcb8f813dd71ad15ea49c21e7f4cdedf03514965decd10012139d4a6449c3742fd2a86aa

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 8202a1cd02e7d69597995cabbe881a12
SHA1 8858d9d934b7aa9330ee73de6c476acf19929ff6
SHA256 58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA512 97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 041e657889c6588f0230a8f1eb731765
SHA1 3d8da592051bf26bf6b1401ceb54e59287c4767c
SHA256 1a13eb4f754ca167b5c3174e82f2a19746f2d5f7245cd6e297a41a741be14bd0
SHA512 b12e422cfd8a6436a7a37d32962ab673e046ac568ea5adfc55313e0d4c26c045ae4762a36863139bf1a1a5dd10e0c01ad23bc41a87a04fb74b9fa34c1bdd1c81

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 7cd52e1f60254a163f879dff01b96792
SHA1 96a3c9d278b909deb256e652de275ac7b6590a6a
SHA256 54796a7ffec5001b47793f9a894f44dfd590b3a2b245e1b5b7fb5ffc5cc70274
SHA512 42e66c3a6c6087d8ccc4399650d474d7c32db5ce3045066f79b7ba9cff053f85219a94ceb7d0a365f3dd4ab20ed6dffa7f7125ec0c9a3740fde15a95008c1b53

C:\Users\Admin\AppData\Local\Temp\Cab6440.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\Roaming\vnc.exe

MD5 1299c227f71353022f7ed366f9efb219
SHA1 b8437949812bd190d66b656cdf99625243e0740f
SHA256 b2ae69e681c120901c4f5f839125d81b53eabd3f22c0a50547604c15d43a33f3
SHA512 0e5276521830eab912247cead3adb5465cd2ad9fdb784999f189c8c854c541f6a671a3bfdce7880fd6c7b4e232c22cb57cfb288a3c71957ee858f1c354c5e26d

memory/1208-126-0x0000000001010000-0x000000000110A000-memory.dmp

memory/1208-128-0x0000000000490000-0x00000000004B0000-memory.dmp

memory/1464-129-0x00000000724DD000-0x00000000724E8000-memory.dmp

memory/2444-130-0x00000000724DD000-0x00000000724E8000-memory.dmp

memory/1208-131-0x00000000004B0000-0x00000000004C0000-memory.dmp

memory/1208-132-0x0000000000500000-0x0000000000516000-memory.dmp

memory/1208-133-0x00000000054C0000-0x0000000005580000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpB1F1.tmp

MD5 e5319a32aae07ca11a0077f066d8b62f
SHA1 feba6e6aef0cc374a91cf357f86eaca5ca6cec95
SHA256 43677b14c2d988affbec9e24d0e5e621eccf94acd45a0a35dbfcb2294b81f2bb
SHA512 a2ad26cbb68c182855049aa15d091cfdef72bb5c581e881c3e779ff0fe70b230ab07c09ea614814e8009b282babd950d7d5c51c51440ee097e40c6ef7eb8a549

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\3JD3Q914V4M7VCXDXWIN.temp

MD5 cace5a725c8ab0fc45960edff6f67038
SHA1 f6bb4215d742c6e5952076dd5c3654de69f1d9e9
SHA256 f9306e291e0970e3da655afd85d56e5e9ad59a9c2335dfb0d021dfb7ddbb1fbf
SHA512 9eed8764321120ab86f57bd9410834a52431044f54eedd8dee7d8aa93b646b126fda06851e5a100aeed7fdb92bd9e030ef5914460411059a9e04f94a8c9ac15b

memory/696-147-0x0000000000400000-0x0000000000482000-memory.dmp

memory/696-149-0x0000000000400000-0x0000000000482000-memory.dmp

memory/696-151-0x0000000000400000-0x0000000000482000-memory.dmp

memory/696-163-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/696-164-0x0000000000400000-0x0000000000482000-memory.dmp

memory/696-162-0x0000000000400000-0x0000000000482000-memory.dmp

memory/696-166-0x0000000000400000-0x0000000000482000-memory.dmp

memory/696-159-0x0000000000400000-0x0000000000482000-memory.dmp

memory/696-157-0x0000000000400000-0x0000000000482000-memory.dmp

memory/696-156-0x0000000000400000-0x0000000000482000-memory.dmp

memory/696-154-0x0000000000400000-0x0000000000482000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-14 01:54

Reported

2024-05-14 01:57

Platform

win10v2004-20240508-en

Max time kernel

148s

Max time network

143s

Command Line

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Order2354.xls"

Signatures

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAuditPrivilege N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 560 wrote to memory of 4036 N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE C:\Windows\splwow64.exe
PID 560 wrote to memory of 4036 N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE C:\Windows\splwow64.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy WMI provider

ransomware

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Order2354.xls"

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" -Embedding

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc

Network

Country Destination Domain Proto
US 8.8.8.8:53 18.89.109.52.in-addr.arpa udp
US 8.8.8.8:53 dokdo.in udp
US 188.114.96.2:80 dokdo.in tcp
US 8.8.8.8:53 2.96.114.188.in-addr.arpa udp
US 188.114.96.2:443 dokdo.in tcp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 67.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 172.93.222.102:80 172.93.222.102 tcp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 102.222.93.172.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 188.114.96.2:80 dokdo.in tcp
US 188.114.96.2:80 dokdo.in tcp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 188.114.96.2:80 dokdo.in tcp
US 188.114.96.2:80 dokdo.in tcp
US 188.114.96.2:80 dokdo.in tcp
US 188.114.96.2:80 dokdo.in tcp
US 188.114.96.2:443 dokdo.in tcp
US 172.93.222.102:80 172.93.222.102 tcp
US 188.114.96.2:80 dokdo.in tcp
US 8.8.8.8:53 40.173.79.40.in-addr.arpa udp
US 188.114.96.2:443 dokdo.in tcp
US 172.93.222.102:80 172.93.222.102 tcp
US 8.8.8.8:53 74.239.69.13.in-addr.arpa udp
US 8.8.8.8:53 metadata.templates.cdn.office.net udp
NL 23.62.61.162:443 metadata.templates.cdn.office.net tcp
US 8.8.8.8:53 binaries.templates.cdn.office.net udp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 8.8.8.8:53 162.61.62.23.in-addr.arpa udp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 2.17.251.17:443 binaries.templates.cdn.office.net tcp
US 8.8.8.8:53 17.251.17.2.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp

Files

memory/3404-0-0x00007FF9B4790000-0x00007FF9B47A0000-memory.dmp

memory/3404-2-0x00007FF9B4790000-0x00007FF9B47A0000-memory.dmp

memory/3404-1-0x00007FF9B4790000-0x00007FF9B47A0000-memory.dmp

memory/3404-3-0x00007FF9B4790000-0x00007FF9B47A0000-memory.dmp

memory/3404-4-0x00007FF9F47AD000-0x00007FF9F47AE000-memory.dmp

memory/3404-9-0x00007FF9F4710000-0x00007FF9F4905000-memory.dmp

memory/3404-8-0x00007FF9F4710000-0x00007FF9F4905000-memory.dmp

memory/3404-10-0x00007FF9F4710000-0x00007FF9F4905000-memory.dmp

memory/3404-7-0x00007FF9F4710000-0x00007FF9F4905000-memory.dmp

memory/3404-11-0x00007FF9B25F0000-0x00007FF9B2600000-memory.dmp

memory/3404-6-0x00007FF9F4710000-0x00007FF9F4905000-memory.dmp

memory/3404-13-0x00007FF9F4710000-0x00007FF9F4905000-memory.dmp

memory/3404-12-0x00007FF9F4710000-0x00007FF9F4905000-memory.dmp

memory/3404-5-0x00007FF9B4790000-0x00007FF9B47A0000-memory.dmp

memory/3404-14-0x00007FF9B25F0000-0x00007FF9B2600000-memory.dmp

memory/3404-17-0x00007FF9F4710000-0x00007FF9F4905000-memory.dmp

memory/3404-18-0x00007FF9F4710000-0x00007FF9F4905000-memory.dmp

memory/3404-20-0x00007FF9F4710000-0x00007FF9F4905000-memory.dmp

memory/3404-19-0x00007FF9F4710000-0x00007FF9F4905000-memory.dmp

memory/3404-16-0x00007FF9F4710000-0x00007FF9F4905000-memory.dmp

memory/3404-15-0x00007FF9F4710000-0x00007FF9F4905000-memory.dmp

memory/560-38-0x00007FF9F4710000-0x00007FF9F4905000-memory.dmp

memory/560-41-0x00007FF9F4710000-0x00007FF9F4905000-memory.dmp

memory/560-43-0x00007FF9F4710000-0x00007FF9F4905000-memory.dmp

memory/560-45-0x00007FF9F4710000-0x00007FF9F4905000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\AD92A6A0-E3E7-4289-B83D-7B04979D5572

MD5 1995684325ffef66eba8f2c91824016b
SHA1 e102ddf7e6ec00c2e11b76cae027acb84f60af6a
SHA256 a1b95726c5961a488eb053b4592c5e7c33094b97912b75bfc5d294b9eb30cd35
SHA512 3fd89c227126d71328312e0d660fd644246ce14114922b7f719b0d165614a9e9dfb3637b860d3a552b5beab548f8df78dc2f81d3091084f4bf4e4ca4a1a5ef59

C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres

MD5 72cd998dd6d3093631a5f46181af0aca
SHA1 297fb9a585ad5643ca9d56cf4ce6b8ba864417f1
SHA256 a9d0b711fb18c02cc4cafb01c7bc7e28f7f415a3434df99cfdca58172f565c85
SHA512 0588ff1b792d76a33512a45d24d5b9af54651dcfac80abca383b32ff6de1f0037fa0d66e942f1b2c13c7c3e432c867e83cd26ec89f91ee223eab6724d34fdcb9

C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

MD5 2c2b15df212600bf198d466a8cee5a0a
SHA1 95b361d7a2132b788b58c8c6b632f0dc7c4759c5
SHA256 e028a2ea10375f7812fcc47f0a60547319cba0e7a79d62f08ea0236c2bc50535
SHA512 6945847c9e8e1d4a92a0e6d939de6ee02cd40ee64a5e90f4cc3bd4a7f564c3fd3a1d13106ff8407860948a86c67d048bc6ef621ddd6042106ba693f5f99c5276

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\W5OVUPOF\beautifulroseflowerwanttogetinhandbecauseitsgreatthingshandbeautiuflthingshappenedtogetback___beautiuflflowers[1].doc

MD5 7a7b11bbe3d337c74805c519c22601c0
SHA1 4b680f33a5d1f26934429bb7dff11b8b3f6ea0f8
SHA256 3f6bd3440b27d64b41ff2902d7b35c1105b7dc026e834755a1b44f63b5da965e
SHA512 c637d681ff8f7e00c74291bf38835ada5d4c074d62f9d5a12ceed7b4ec540f21e05dc89469664af08d7a68040e5d0646e1f13669ddec965812ce9eeb78975302

C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

MD5 5db91e83608ae891debab17c5f65f6f2
SHA1 d016ab90b358325483f8afe4173071094b858f4c
SHA256 f88360415fd97c4df31fcf259e9264b138fc825d7a4e68e25e1cf3b3b018f8c2
SHA512 6801e217d58c24674bbaddb15f3d1da28f21c19191e16aae2c3a33ef634c8a65c9370d55f1542c8567aafd975fc4f6775a1d39eba49ec104d5d79601ff0330db

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 e911d5250fd2c67530801b2c146e56ad
SHA1 c5452baaee6e85d4129c0f35f5d4182fa3b225f8
SHA256 c27edf2fc78bb8ea82d5bca8f2aa9a6ba9a7a62f8e75c9f1af92dec7bfcb229d
SHA512 0eb3e6a4bffe7eca9f3c62e89c71f92b2e4527cd240cfd0743a5abf492e44f7c22128c402c02b34177f34ae83f06fa24cf22fbabab58ecc4fc4935e342f56b1d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 8202a1cd02e7d69597995cabbe881a12
SHA1 8858d9d934b7aa9330ee73de6c476acf19929ff6
SHA256 58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA512 97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 e74a81fd65531e7dc7e3669d7c4aa321
SHA1 3bff41919b6874add7c771488330c82f6eb44980
SHA256 cdeb76a9f4befaf1b4276f83fcf45345eb019836239970a62f778e31005415f5
SHA512 82f54734076bf13802733ab83851240c46da2873d75aa1b2d18c99ddd7b54049be5310635ed154d540961a2421b92234c2a15fd722a0ef5a601f18ef2d219780

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 6cc13b35eaa13746c4ea18555bf5a1f0
SHA1 c107227f4d4ba7505994e27f772a5f50f6905282
SHA256 18d9c79ca860891835137d03780f617dc0c3fba50bc368aa68b2c13071fe9a58
SHA512 5f4d3975e5986e3bc7437495b853abbd98569a056a2d8555c79d0396afba75d0b5a9d233dde06866d921a45d6c0fef541d5e9308afa8c988c4687911f5669145

C:\Users\Admin\AppData\Local\Microsoft\Office\DLP\mip\logs\mip_sdk.miplog

MD5 2800f426e7521eaf9a7e1c5ee1cf49ba
SHA1 e14f16876e8067b681267bafacb570620f8d8f3e
SHA256 7c1bbde9508f154d1b3a4bcbdcdc4a1d02dbcf9728f660903a986f2c94311c0b
SHA512 c9c7b2e14b2f92f93019aee2f3f1fc419ffc9b06749d9a1d7bd8985c6216e9edcdef0a1a600ac4bfbcd6345efff9b4030624c133c7a6217a1c789a1e16526612

C:\Users\Admin\AppData\Local\Temp\TCD9261.tmp\iso690.xsl

MD5 ff0e07eff1333cdf9fc2523d323dd654
SHA1 77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA256 3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
SHA512 b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

MD5 70bcddec976f67523d5da52340655a1b
SHA1 0574655c153d6bc8273ac6bf2794bb02a53ff8ff
SHA256 bf59eeab76bb876de2299a9c7968d841641eda49b4832c2860ad6cd24023e57a
SHA512 799e8c8f767004535443bb0ea2c9f02a07230d38aa6127ce77faac6187aebdc0a874f16dc537263a1fc7fe436171be618f878ac4ad782f378cdbbf5d71f1c8ee

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

MD5 8303e1f2d92b394c16a29a1f6d87c4ac
SHA1 d779d732b437a8a4134e14bd6b1a05a234da0891
SHA256 70ea701b14c15a3726864e4785808a7dfdc600d1d272c5f20239f4cf919320d3
SHA512 4427e8651784142b6daf692f832e8da493533e8e5ca1d6d19a5171dc487ba05bb09998bc5133f8d9657d1c44c536c9823d65de9c47b4c0b4ed350052b1c7ced6

memory/3404-563-0x00007FF9F4710000-0x00007FF9F4905000-memory.dmp

memory/560-573-0x00007FF9F4710000-0x00007FF9F4905000-memory.dmp