Analysis
-
max time kernel
147s -
max time network
133s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
30-06-2020 02:04
Static task
static1
Behavioral task
behavioral1
Sample
StolenImagesEvidence.xlsm
Resource
win7
Behavioral task
behavioral2
Sample
StolenImagesEvidence.xlsm
Resource
win10v200430
General
-
Target
StolenImagesEvidence.xlsm
-
Size
2.7MB
-
MD5
19e4dc06d4ccb13ede93bd8a3f115848
-
SHA1
f6f89dd11b43563abfbe19572d61168ab95825ee
-
SHA256
d3e6f290c2bb3453ca9c6eca018c3256d5a4e0e8bf3ab26316d904f3dfa82c23
-
SHA512
12bf4eb62cda66cd25aeb8ee9f0e6ba7e6633b7bcf424ed321f7f7f0f0e6279ec4470a06ddd95eb431d843eb0805b10dac8e7eeba7bda6803f287d1a9fd7d960
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
gennt.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProgramData\\e0fb894d1ddbd54172ba\\gennt.exe\"" gennt.exe -
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cscript.exedescription pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3980 3768 cscript.exe 65 -
Blocklisted process makes network request 1 IoCs
Processes:
cscript.exeflow pid Process 19 3980 cscript.exe -
Executes dropped EXE 2 IoCs
Processes:
honey.exegennt.exepid Process 3704 honey.exe 3740 gennt.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
NTFS ADS 3 IoCs
Processes:
EXCEL.EXEdescription ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\mm:Zone.Identifier EXCEL.EXE File opened for modification C:\Users\Admin\AppData\Local\Temp\xx:Zone.Identifier EXCEL.EXE File created C:\programdata\asc.txt:script1.vbs EXCEL.EXE -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 19 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid Process 3768 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid Process 3768 EXCEL.EXE 3768 EXCEL.EXE 3768 EXCEL.EXE 3768 EXCEL.EXE 3768 EXCEL.EXE 3768 EXCEL.EXE 3768 EXCEL.EXE 3768 EXCEL.EXE 3768 EXCEL.EXE 3768 EXCEL.EXE 3768 EXCEL.EXE 3768 EXCEL.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
EXCEL.EXEcscript.exehoney.exegennt.exedescription pid Process procid_target PID 3768 wrote to memory of 3980 3768 EXCEL.EXE 72 PID 3768 wrote to memory of 3980 3768 EXCEL.EXE 72 PID 3980 wrote to memory of 3704 3980 cscript.exe 74 PID 3980 wrote to memory of 3704 3980 cscript.exe 74 PID 3980 wrote to memory of 3704 3980 cscript.exe 74 PID 3704 wrote to memory of 3740 3704 honey.exe 78 PID 3704 wrote to memory of 3740 3704 honey.exe 78 PID 3704 wrote to memory of 3740 3704 honey.exe 78 PID 3740 wrote to memory of 3724 3740 gennt.exe 79 PID 3740 wrote to memory of 3724 3740 gennt.exe 79 PID 3740 wrote to memory of 3724 3740 gennt.exe 79
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\StolenImagesEvidence.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Windows\System32\cscript.exe"C:\Windows\System32\cscript.exe" C:\programdata\asc.txt:script1.vbs2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\programdata\honey.exeC:\programdata\honey.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\ProgramData\e0fb894d1ddbd54172ba\gennt.exeC:\ProgramData\e0fb894d1ddbd54172ba\gennt.exe "C:\programdata\honey.exe" ensgJJ4⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Windows\SysWOW64\secinit.exeC:\ProgramData\e0fb894d1ddbd54172ba\gennt.exe5⤵PID:3724
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
f500854e3cf9556688203a3d869b7d6d
SHA1281aab2eb26f31cf2255e2f5a467fc5eebda8df8
SHA256471325daa2bc75f50856e93e9de088386556fc3ead653894d5c2a67f2a8b4975
SHA512bccb54a68003bde3304dd6824f4bc6a3a5f06995a85bf371b1581fd00e0dc9ff40a1765594b61da9a2cbdf9c0372916a8694af2a66759a534b746981418101d4
-
MD5
f500854e3cf9556688203a3d869b7d6d
SHA1281aab2eb26f31cf2255e2f5a467fc5eebda8df8
SHA256471325daa2bc75f50856e93e9de088386556fc3ead653894d5c2a67f2a8b4975
SHA512bccb54a68003bde3304dd6824f4bc6a3a5f06995a85bf371b1581fd00e0dc9ff40a1765594b61da9a2cbdf9c0372916a8694af2a66759a534b746981418101d4
-
MD5
f500854e3cf9556688203a3d869b7d6d
SHA1281aab2eb26f31cf2255e2f5a467fc5eebda8df8
SHA256471325daa2bc75f50856e93e9de088386556fc3ead653894d5c2a67f2a8b4975
SHA512bccb54a68003bde3304dd6824f4bc6a3a5f06995a85bf371b1581fd00e0dc9ff40a1765594b61da9a2cbdf9c0372916a8694af2a66759a534b746981418101d4
-
MD5
db247f41725eccc95440e0de0cb454b0
SHA1c18af0fcdf083be64fa139e1120b1526ba45d7b6
SHA256f65cf77551c4c20c63985a74e7886651ec063996b0fc8e1a486801e27a9bdb88
SHA512f5c4569e6d729885c55cd129461795dc96fa5efdb1e85a99282b149003c785272e148f6a728f66398f3364c9354af1393df7c5e0f2582112dfd4e7d7045c6f5a
-
MD5
f500854e3cf9556688203a3d869b7d6d
SHA1281aab2eb26f31cf2255e2f5a467fc5eebda8df8
SHA256471325daa2bc75f50856e93e9de088386556fc3ead653894d5c2a67f2a8b4975
SHA512bccb54a68003bde3304dd6824f4bc6a3a5f06995a85bf371b1581fd00e0dc9ff40a1765594b61da9a2cbdf9c0372916a8694af2a66759a534b746981418101d4