cfc6981de86af094cf3db2e7ae18d12e843ec0af676775163da859034b872f8f

Analysis

max time kernel
140s
max time network
82s
platform
windows7_x64
resource
win7v200430
submitted
07/07/2020, 06:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Pro-forma Da.xlsm
Size

48KB
MD5

1b9914f176f853c624ff4727bb45180a
SHA1

7da7342da3b8e83b2d8e3783d7044c42c23385f0
SHA256

cfc6981de86af094cf3db2e7ae18d12e843ec0af676775163da859034b872f8f
SHA512

b7072ab08115b8dbe9f1efed333fe0eb003be4ad9370115b7175b71c27e8f5faa1e582f48827a46b6b8e1e190be244342199e9bd460e47d80d99888123e86cd1

Score

10^/10

spyware

Malware Config

Signatures

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 1692	1528	EQNEDT32.EXE	25
PID 1528 wrote to memory of 1692	1528	EQNEDT32.EXE	25
PID 1528 wrote to memory of 1692	1528	EQNEDT32.EXE	25
PID 1528 wrote to memory of 1692	1528	EQNEDT32.EXE	25
PID 1692 wrote to memory of 1764	1692	cmd.exe	27
PID 1692 wrote to memory of 1764	1692	cmd.exe	27
PID 1692 wrote to memory of 1764	1692	cmd.exe	27
PID 1692 wrote to memory of 1764	1692	cmd.exe	27
PID 1764 wrote to memory of 1748	1764	cscript.exe	28
PID 1764 wrote to memory of 1748	1764	cscript.exe	28
PID 1764 wrote to memory of 1748	1764	cscript.exe	28
PID 1764 wrote to memory of 1748	1764	cscript.exe	28
PID 272 wrote to memory of 1916	272	EXCEL.EXE	29
PID 272 wrote to memory of 1916	272	EXCEL.EXE	29
PID 272 wrote to memory of 1916	272	EXCEL.EXE	29
PID 1748 wrote to memory of 1856	1748	cmd.exe	32
PID 1748 wrote to memory of 1856	1748	cmd.exe	32
PID 1748 wrote to memory of 1856	1748	cmd.exe	32
PID 1748 wrote to memory of 1856	1748	cmd.exe	32
PID 1916 wrote to memory of 1076	1916	cscript.exe	34
PID 1916 wrote to memory of 1076	1916	cscript.exe	34
PID 1916 wrote to memory of 1076	1916	cscript.exe	34
PID 1916 wrote to memory of 1076	1916	cscript.exe	34
PID 1076 wrote to memory of 1792	1076	b0zjyDTDj3.exe	37
PID 1076 wrote to memory of 1792	1076	b0zjyDTDj3.exe	37
PID 1076 wrote to memory of 1792	1076	b0zjyDTDj3.exe	37
PID 1076 wrote to memory of 1792	1076	b0zjyDTDj3.exe	37
PID 1076 wrote to memory of 1900	1076	b0zjyDTDj3.exe	39
PID 1076 wrote to memory of 1900	1076	b0zjyDTDj3.exe	39
PID 1076 wrote to memory of 1900	1076	b0zjyDTDj3.exe	39
PID 1076 wrote to memory of 1900	1076	b0zjyDTDj3.exe	39
PID 1076 wrote to memory of 1900	1076	b0zjyDTDj3.exe	39
PID 1076 wrote to memory of 1900	1076	b0zjyDTDj3.exe	39
PID 1076 wrote to memory of 1900	1076	b0zjyDTDj3.exe	39
PID 1076 wrote to memory of 1900	1076	b0zjyDTDj3.exe	39
PID 1076 wrote to memory of 1900	1076	b0zjyDTDj3.exe	39

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1916	272	cscript.exe	23

Blacklisted process makes network request 2 IoCs

flow	pid	Process
1	1916	cscript.exe
2	1856	cscript.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1076	b0zjyDTDj3.exe
Token: SeDebugPrivilege	1900	b0zjyDTDj3.exe

Office loads VBA resources, possible macro or embedded object present

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
272	EXCEL.EXE

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
272	EXCEL.EXE
272	EXCEL.EXE
272	EXCEL.EXE
1900	b0zjyDTDj3.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Executes dropped EXE 2 IoCs

pid	Process
1076	b0zjyDTDj3.exe
1900	b0zjyDTDj3.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1792	schtasks.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1076 set thread context of 1900	1076	b0zjyDTDj3.exe	39

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1076	b0zjyDTDj3.exe
1900	b0zjyDTDj3.exe
1900	b0zjyDTDj3.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\programdata\asc.txt:script1.vbs	EXCEL.EXE

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Script User-Agent 2 IoCs

description	flow	ioc
HTTP User-Agent header	2	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	1	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Launches Equation Editor 1 TTPs 1 IoCs

Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

exploit

Exploitation for Client Execution

T1203

pid	Process
1528	EQNEDT32.EXE

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\Pro-forma Da.xlsm"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- NTFS ADS
PID:272
- C:\Windows\System32\cscript.exe
  "C:\Windows\System32\cscript.exe" C:\programdata\asc.txt:script1.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  - Process spawned unexpected child process
  - Blacklisted process makes network request
  PID:1916
- - C:\programdata\b0zjyDTDj3.exe
    C:\programdata\b0zjyDTDj3.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    - Suspicious use of AdjustPrivilegeToken
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    PID:1076
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\enWFIQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCB49.tmp"
      4⤵
      Creates scheduled task(s)
      PID:1792
  - - C:\programdata\b0zjyDTDj3.exe
      "{path}"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1900

C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
1⤵
- Suspicious use of WriteProcessMemory
- Launches Equation Editor
PID:1528
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ren %tmp%\mm v&cScrIPT %tmp%\v?..wsf C
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Windows\SysWOW64\cscript.exe
    cScrIPT C:\Users\Admin\AppData\Local\Temp\v?..wsf C
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1764
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c cscript C:\Users\Admin\AppData\Local\Temp\xx.vbs
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1748
    - - C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp\xx.vbs
        5⤵
        Blacklisted process makes network request
        
        PID:1856

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Exploitation for Client Execution

T1203

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/272-3-0x00000000004BB000-0x00000000004C0000-memory.dmp

Filesize
20KB

Download
memory/1764-9-0x0000000002710000-0x0000000002714000-memory.dmp

Filesize
16KB

Download
memory/1856-15-0x0000000002790000-0x0000000002794000-memory.dmp

Filesize
16KB

Download
memory/1900-21-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1900-24-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1900-25-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1916-14-0x0000000002560000-0x0000000002564000-memory.dmp

Filesize
16KB

Download