Analysis

  • max time kernel
    147s
  • max time network
    133s
  • platform
    windows10_x64
  • resource
    win10v200430
  • submitted
    30-06-2020 02:04

General

  • Target

    StolenImagesEvidence.xlsm

  • Size

    2.7MB

  • MD5

    19e4dc06d4ccb13ede93bd8a3f115848

  • SHA1

    f6f89dd11b43563abfbe19572d61168ab95825ee

  • SHA256

    d3e6f290c2bb3453ca9c6eca018c3256d5a4e0e8bf3ab26316d904f3dfa82c23

  • SHA512

    12bf4eb62cda66cd25aeb8ee9f0e6ba7e6633b7bcf424ed321f7f7f0f0e6279ec4470a06ddd95eb431d843eb0805b10dac8e7eeba7bda6803f287d1a9fd7d960

Score
10/10

Malware Config

Signatures

  • Buer

    Buer is a new modular loader first seen in August 2019.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • NTFS ADS 3 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\StolenImagesEvidence.xlsm"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • NTFS ADS
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3768
    • C:\Windows\System32\cscript.exe
      "C:\Windows\System32\cscript.exe" C:\programdata\asc.txt:script1.vbs
      2⤵
      • Process spawned unexpected child process
      • Blocklisted process makes network request
      • Suspicious use of WriteProcessMemory
      PID:3980
      • C:\programdata\honey.exe
        C:\programdata\honey.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3704
        • C:\ProgramData\e0fb894d1ddbd54172ba\gennt.exe
          C:\ProgramData\e0fb894d1ddbd54172ba\gennt.exe "C:\programdata\honey.exe" ensgJJ
          4⤵
          • Modifies WinLogon for persistence
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3740
          • C:\Windows\SysWOW64\secinit.exe
            C:\ProgramData\e0fb894d1ddbd54172ba\gennt.exe
            5⤵
              PID:3724

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3768-3-0x000002BD44FE5000-0x000002BD44FEB000-memory.dmp

      Filesize

      24KB

    • memory/3768-5-0x000002BD4C326000-0x000002BD4C32B000-memory.dmp

      Filesize

      20KB

    • memory/3768-4-0x000002BD4C324000-0x000002BD4C326000-memory.dmp

      Filesize

      8KB

    • memory/3768-0-0x000002BD4BFC9000-0x000002BD4BFCE000-memory.dmp

      Filesize

      20KB

    • memory/3768-2-0x000002BD4C324000-0x000002BD4C326000-memory.dmp

      Filesize

      8KB

    • memory/3768-1-0x000002BD44FE5000-0x000002BD44FEB000-memory.dmp

      Filesize

      24KB