Analysis
-
max time kernel
149s -
max time network
131s -
platform
windows7_x64 -
resource
win7 -
submitted
30-06-2020 02:04
Static task
static1
Behavioral task
behavioral1
Sample
StolenImagesEvidence.xlsm
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
StolenImagesEvidence.xlsm
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
StolenImagesEvidence.xlsm
-
Size
2.7MB
-
MD5
19e4dc06d4ccb13ede93bd8a3f115848
-
SHA1
f6f89dd11b43563abfbe19572d61168ab95825ee
-
SHA256
d3e6f290c2bb3453ca9c6eca018c3256d5a4e0e8bf3ab26316d904f3dfa82c23
-
SHA512
12bf4eb62cda66cd25aeb8ee9f0e6ba7e6633b7bcf424ed321f7f7f0f0e6279ec4470a06ddd95eb431d843eb0805b10dac8e7eeba7bda6803f287d1a9fd7d960
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProgramData\\42a9a9fda9eb1654f552\\gennt.exe\"" gennt.exe -
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1808 1100 cscript.exe 23 -
Blocklisted process makes network request 2 IoCs
flow pid Process 2 1788 cscript.exe 3 1808 cscript.exe -
Executes dropped EXE 4 IoCs
pid Process 1536 honey.exe 1952 honey.exe 1636 gennt.exe 1760 exgitucedis.exe -
Loads dropped DLL 5 IoCs
pid Process 1788 cscript.exe 1952 honey.exe 1952 honey.exe 1636 gennt.exe 1636 gennt.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: gennt.exe File opened (read-only) \??\F: gennt.exe File opened (read-only) \??\G: gennt.exe File opened (read-only) \??\P: gennt.exe File opened (read-only) \??\S: gennt.exe File opened (read-only) \??\W: gennt.exe File opened (read-only) \??\X: gennt.exe File opened (read-only) \??\Z: gennt.exe File opened (read-only) \??\H: gennt.exe File opened (read-only) \??\J: gennt.exe File opened (read-only) \??\N: gennt.exe File opened (read-only) \??\R: gennt.exe File opened (read-only) \??\T: gennt.exe File opened (read-only) \??\U: gennt.exe File opened (read-only) \??\V: gennt.exe File opened (read-only) \??\B: gennt.exe File opened (read-only) \??\K: gennt.exe File opened (read-only) \??\O: gennt.exe File opened (read-only) \??\Q: gennt.exe File opened (read-only) \??\Y: gennt.exe File opened (read-only) \??\E: gennt.exe File opened (read-only) \??\I: gennt.exe File opened (read-only) \??\L: gennt.exe File opened (read-only) \??\M: gennt.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 1508 1044 WerFault.exe 40 -
Office loads VBA resources, possible macro or embedded object present
-
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
pid Process 1464 EQNEDT32.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{536913E1-BA76-11EA-BBCA-D6F86DC1AE1E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe -
NTFS ADS 1 IoCs
description ioc Process File created C:\programdata\asc.txt:script1.vbs EXCEL.EXE -
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 2 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 3 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1100 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1508 WerFault.exe 1508 WerFault.exe 1508 WerFault.exe 1508 WerFault.exe 1508 WerFault.exe 1636 gennt.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1508 WerFault.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1484 iexplore.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 1100 EXCEL.EXE 1100 EXCEL.EXE 1100 EXCEL.EXE 1484 iexplore.exe 1484 iexplore.exe 1172 IEXPLORE.EXE 1172 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 56 IoCs
description pid Process procid_target PID 1464 wrote to memory of 836 1464 EQNEDT32.EXE 25 PID 1464 wrote to memory of 836 1464 EQNEDT32.EXE 25 PID 1464 wrote to memory of 836 1464 EQNEDT32.EXE 25 PID 1464 wrote to memory of 836 1464 EQNEDT32.EXE 25 PID 836 wrote to memory of 744 836 cmd.exe 27 PID 836 wrote to memory of 744 836 cmd.exe 27 PID 836 wrote to memory of 744 836 cmd.exe 27 PID 836 wrote to memory of 744 836 cmd.exe 27 PID 744 wrote to memory of 1484 744 wscript.exe 28 PID 744 wrote to memory of 1484 744 wscript.exe 28 PID 744 wrote to memory of 1484 744 wscript.exe 28 PID 744 wrote to memory of 1484 744 wscript.exe 28 PID 1484 wrote to memory of 1788 1484 cmd.exe 30 PID 1484 wrote to memory of 1788 1484 cmd.exe 30 PID 1484 wrote to memory of 1788 1484 cmd.exe 30 PID 1484 wrote to memory of 1788 1484 cmd.exe 30 PID 1100 wrote to memory of 1808 1100 EXCEL.EXE 31 PID 1100 wrote to memory of 1808 1100 EXCEL.EXE 31 PID 1100 wrote to memory of 1808 1100 EXCEL.EXE 31 PID 1808 wrote to memory of 1536 1808 cscript.exe 34 PID 1808 wrote to memory of 1536 1808 cscript.exe 34 PID 1808 wrote to memory of 1536 1808 cscript.exe 34 PID 1808 wrote to memory of 1536 1808 cscript.exe 34 PID 1788 wrote to memory of 1952 1788 cscript.exe 36 PID 1788 wrote to memory of 1952 1788 cscript.exe 36 PID 1788 wrote to memory of 1952 1788 cscript.exe 36 PID 1788 wrote to memory of 1952 1788 cscript.exe 36 PID 1952 wrote to memory of 1636 1952 honey.exe 39 PID 1952 wrote to memory of 1636 1952 honey.exe 39 PID 1952 wrote to memory of 1636 1952 honey.exe 39 PID 1952 wrote to memory of 1636 1952 honey.exe 39 PID 1636 wrote to memory of 1044 1636 gennt.exe 40 PID 1636 wrote to memory of 1044 1636 gennt.exe 40 PID 1636 wrote to memory of 1044 1636 gennt.exe 40 PID 1636 wrote to memory of 1044 1636 gennt.exe 40 PID 1636 wrote to memory of 1044 1636 gennt.exe 40 PID 1636 wrote to memory of 1044 1636 gennt.exe 40 PID 1636 wrote to memory of 1044 1636 gennt.exe 40 PID 1636 wrote to memory of 1044 1636 gennt.exe 40 PID 1636 wrote to memory of 1044 1636 gennt.exe 40 PID 1044 wrote to memory of 1508 1044 secinit.exe 41 PID 1044 wrote to memory of 1508 1044 secinit.exe 41 PID 1044 wrote to memory of 1508 1044 secinit.exe 41 PID 1044 wrote to memory of 1508 1044 secinit.exe 41 PID 1636 wrote to memory of 836 1636 gennt.exe 42 PID 1636 wrote to memory of 836 1636 gennt.exe 42 PID 1636 wrote to memory of 836 1636 gennt.exe 42 PID 1636 wrote to memory of 836 1636 gennt.exe 42 PID 1636 wrote to memory of 1760 1636 gennt.exe 44 PID 1636 wrote to memory of 1760 1636 gennt.exe 44 PID 1636 wrote to memory of 1760 1636 gennt.exe 44 PID 1636 wrote to memory of 1760 1636 gennt.exe 44 PID 1484 wrote to memory of 1172 1484 iexplore.exe 48 PID 1484 wrote to memory of 1172 1484 iexplore.exe 48 PID 1484 wrote to memory of 1172 1484 iexplore.exe 48 PID 1484 wrote to memory of 1172 1484 iexplore.exe 48
Processes
-
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\StolenImagesEvidence.xlsm1⤵
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Windows\System32\cscript.exe"C:\Windows\System32\cscript.exe" C:\programdata\asc.txt:script1.vbs2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\programdata\honey.exeC:\programdata\honey.exe3⤵
- Executes dropped EXE
PID:1536
-
-
-
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Windows\SysWOW64\cmd.execmd /c ren %tmp%\mm v&WSCRIPT %tmp%\v?..wsf C2⤵
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Windows\SysWOW64\wscript.exeWSCRIPT C:\Users\Admin\AppData\Local\Temp\v?..wsf C3⤵
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cscript C:\Users\Admin\AppData\Local\Temp\xx.vbs4⤵
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp\xx.vbs5⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\ProgramData\honey.exe"C:\ProgramData\honey.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\ProgramData\42a9a9fda9eb1654f552\gennt.exeC:\ProgramData\42a9a9fda9eb1654f552\gennt.exe "C:\ProgramData\honey.exe" ensgJJ7⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Windows\SysWOW64\secinit.exeC:\ProgramData\42a9a9fda9eb1654f552\gennt.exe8⤵
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1044 -s 2809⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1508
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" powershell.exe -Command "& {Add-MpPreference -ExclusionPath C:\ProgramData\42a9a9fda9eb1654f552}"8⤵PID:836
-
-
C:\ProgramData\42a9a9fda9eb1654f552\exgitucedis.exeC:\ProgramData\42a9a9fda9eb1654f552\exgitucedis.exe8⤵
- Executes dropped EXE
PID:1760
-
-
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1484 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1172
-