Analysis
-
max time kernel
147s -
max time network
133s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
30-06-2020 02:04
Static task
static1
Behavioral task
behavioral1
Sample
StolenImagesEvidence.xlsm
Resource
win7
Behavioral task
behavioral2
Sample
StolenImagesEvidence.xlsm
Resource
win10v200430
General
-
Target
StolenImagesEvidence.xlsm
-
Size
2.7MB
-
MD5
19e4dc06d4ccb13ede93bd8a3f115848
-
SHA1
f6f89dd11b43563abfbe19572d61168ab95825ee
-
SHA256
d3e6f290c2bb3453ca9c6eca018c3256d5a4e0e8bf3ab26316d904f3dfa82c23
-
SHA512
12bf4eb62cda66cd25aeb8ee9f0e6ba7e6633b7bcf424ed321f7f7f0f0e6279ec4470a06ddd95eb431d843eb0805b10dac8e7eeba7bda6803f287d1a9fd7d960
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProgramData\\e0fb894d1ddbd54172ba\\gennt.exe\"" gennt.exe -
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3980 3768 cscript.exe 65 -
Blocklisted process makes network request 1 IoCs
flow pid Process 19 3980 cscript.exe -
Executes dropped EXE 2 IoCs
pid Process 3704 honey.exe 3740 gennt.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
NTFS ADS 3 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\mm:Zone.Identifier EXCEL.EXE File opened for modification C:\Users\Admin\AppData\Local\Temp\xx:Zone.Identifier EXCEL.EXE File created C:\programdata\asc.txt:script1.vbs EXCEL.EXE -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 19 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3768 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 3768 EXCEL.EXE 3768 EXCEL.EXE 3768 EXCEL.EXE 3768 EXCEL.EXE 3768 EXCEL.EXE 3768 EXCEL.EXE 3768 EXCEL.EXE 3768 EXCEL.EXE 3768 EXCEL.EXE 3768 EXCEL.EXE 3768 EXCEL.EXE 3768 EXCEL.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3768 wrote to memory of 3980 3768 EXCEL.EXE 72 PID 3768 wrote to memory of 3980 3768 EXCEL.EXE 72 PID 3980 wrote to memory of 3704 3980 cscript.exe 74 PID 3980 wrote to memory of 3704 3980 cscript.exe 74 PID 3980 wrote to memory of 3704 3980 cscript.exe 74 PID 3704 wrote to memory of 3740 3704 honey.exe 78 PID 3704 wrote to memory of 3740 3704 honey.exe 78 PID 3704 wrote to memory of 3740 3704 honey.exe 78 PID 3740 wrote to memory of 3724 3740 gennt.exe 79 PID 3740 wrote to memory of 3724 3740 gennt.exe 79 PID 3740 wrote to memory of 3724 3740 gennt.exe 79
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\StolenImagesEvidence.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Windows\System32\cscript.exe"C:\Windows\System32\cscript.exe" C:\programdata\asc.txt:script1.vbs2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\programdata\honey.exeC:\programdata\honey.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\ProgramData\e0fb894d1ddbd54172ba\gennt.exeC:\ProgramData\e0fb894d1ddbd54172ba\gennt.exe "C:\programdata\honey.exe" ensgJJ4⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Windows\SysWOW64\secinit.exeC:\ProgramData\e0fb894d1ddbd54172ba\gennt.exe5⤵PID:3724
-
-
-
-