Analysis
-
max time kernel
140s -
max time network
82s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
07-07-2020 06:08
Static task
static1
Behavioral task
behavioral1
Sample
Pro-forma Da.xlsm
Resource
win7v200430
Behavioral task
behavioral2
Sample
Pro-forma Da.xlsm
Resource
win10
General
-
Target
Pro-forma Da.xlsm
-
Size
48KB
-
MD5
1b9914f176f853c624ff4727bb45180a
-
SHA1
7da7342da3b8e83b2d8e3783d7044c42c23385f0
-
SHA256
cfc6981de86af094cf3db2e7ae18d12e843ec0af676775163da859034b872f8f
-
SHA512
b7072ab08115b8dbe9f1efed333fe0eb003be4ad9370115b7175b71c27e8f5faa1e582f48827a46b6b8e1e190be244342199e9bd460e47d80d99888123e86cd1
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
EQNEDT32.EXEcmd.execscript.exeEXCEL.EXEcmd.execscript.exeb0zjyDTDj3.exedescription pid process target process PID 1528 wrote to memory of 1692 1528 EQNEDT32.EXE cmd.exe PID 1528 wrote to memory of 1692 1528 EQNEDT32.EXE cmd.exe PID 1528 wrote to memory of 1692 1528 EQNEDT32.EXE cmd.exe PID 1528 wrote to memory of 1692 1528 EQNEDT32.EXE cmd.exe PID 1692 wrote to memory of 1764 1692 cmd.exe cscript.exe PID 1692 wrote to memory of 1764 1692 cmd.exe cscript.exe PID 1692 wrote to memory of 1764 1692 cmd.exe cscript.exe PID 1692 wrote to memory of 1764 1692 cmd.exe cscript.exe PID 1764 wrote to memory of 1748 1764 cscript.exe cmd.exe PID 1764 wrote to memory of 1748 1764 cscript.exe cmd.exe PID 1764 wrote to memory of 1748 1764 cscript.exe cmd.exe PID 1764 wrote to memory of 1748 1764 cscript.exe cmd.exe PID 272 wrote to memory of 1916 272 EXCEL.EXE cscript.exe PID 272 wrote to memory of 1916 272 EXCEL.EXE cscript.exe PID 272 wrote to memory of 1916 272 EXCEL.EXE cscript.exe PID 1748 wrote to memory of 1856 1748 cmd.exe cscript.exe PID 1748 wrote to memory of 1856 1748 cmd.exe cscript.exe PID 1748 wrote to memory of 1856 1748 cmd.exe cscript.exe PID 1748 wrote to memory of 1856 1748 cmd.exe cscript.exe PID 1916 wrote to memory of 1076 1916 cscript.exe b0zjyDTDj3.exe PID 1916 wrote to memory of 1076 1916 cscript.exe b0zjyDTDj3.exe PID 1916 wrote to memory of 1076 1916 cscript.exe b0zjyDTDj3.exe PID 1916 wrote to memory of 1076 1916 cscript.exe b0zjyDTDj3.exe PID 1076 wrote to memory of 1792 1076 b0zjyDTDj3.exe schtasks.exe PID 1076 wrote to memory of 1792 1076 b0zjyDTDj3.exe schtasks.exe PID 1076 wrote to memory of 1792 1076 b0zjyDTDj3.exe schtasks.exe PID 1076 wrote to memory of 1792 1076 b0zjyDTDj3.exe schtasks.exe PID 1076 wrote to memory of 1900 1076 b0zjyDTDj3.exe b0zjyDTDj3.exe PID 1076 wrote to memory of 1900 1076 b0zjyDTDj3.exe b0zjyDTDj3.exe PID 1076 wrote to memory of 1900 1076 b0zjyDTDj3.exe b0zjyDTDj3.exe PID 1076 wrote to memory of 1900 1076 b0zjyDTDj3.exe b0zjyDTDj3.exe PID 1076 wrote to memory of 1900 1076 b0zjyDTDj3.exe b0zjyDTDj3.exe PID 1076 wrote to memory of 1900 1076 b0zjyDTDj3.exe b0zjyDTDj3.exe PID 1076 wrote to memory of 1900 1076 b0zjyDTDj3.exe b0zjyDTDj3.exe PID 1076 wrote to memory of 1900 1076 b0zjyDTDj3.exe b0zjyDTDj3.exe PID 1076 wrote to memory of 1900 1076 b0zjyDTDj3.exe b0zjyDTDj3.exe -
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cscript.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1916 272 cscript.exe EXCEL.EXE -
Blacklisted process makes network request 2 IoCs
Processes:
cscript.execscript.exeflow pid process 1 1916 cscript.exe 2 1856 cscript.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
b0zjyDTDj3.exeb0zjyDTDj3.exedescription pid process Token: SeDebugPrivilege 1076 b0zjyDTDj3.exe Token: SeDebugPrivilege 1900 b0zjyDTDj3.exe -
Office loads VBA resources, possible macro or embedded object present
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 272 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
EXCEL.EXEb0zjyDTDj3.exepid process 272 EXCEL.EXE 272 EXCEL.EXE 272 EXCEL.EXE 1900 b0zjyDTDj3.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Executes dropped EXE 2 IoCs
Processes:
b0zjyDTDj3.exeb0zjyDTDj3.exepid process 1076 b0zjyDTDj3.exe 1900 b0zjyDTDj3.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
b0zjyDTDj3.exedescription pid process target process PID 1076 set thread context of 1900 1076 b0zjyDTDj3.exe b0zjyDTDj3.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
b0zjyDTDj3.exeb0zjyDTDj3.exepid process 1076 b0zjyDTDj3.exe 1900 b0zjyDTDj3.exe 1900 b0zjyDTDj3.exe -
NTFS ADS 1 IoCs
Processes:
EXCEL.EXEdescription ioc process File created C:\programdata\asc.txt:script1.vbs EXCEL.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Script User-Agent 2 IoCs
Processes:
description flow ioc HTTP User-Agent header 2 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 1 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
Processes
-
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\Pro-forma Da.xlsm"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- NTFS ADS
-
C:\Windows\System32\cscript.exe"C:\Windows\System32\cscript.exe" C:\programdata\asc.txt:script1.vbs2⤵
- Suspicious use of WriteProcessMemory
- Process spawned unexpected child process
- Blacklisted process makes network request
-
C:\programdata\b0zjyDTDj3.exeC:\programdata\b0zjyDTDj3.exe3⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\enWFIQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCB49.tmp"4⤵
- Creates scheduled task(s)
-
C:\programdata\b0zjyDTDj3.exe"{path}"4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Suspicious use of WriteProcessMemory
- Launches Equation Editor
-
C:\Windows\SysWOW64\cmd.execmd /c ren %tmp%\mm v&cScrIPT %tmp%\v?..wsf C2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execScrIPT C:\Users\Admin\AppData\Local\Temp\v?..wsf C3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cscript C:\Users\Admin\AppData\Local\Temp\xx.vbs4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp\xx.vbs5⤵
- Blacklisted process makes network request
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\b0zjyDTDj3.exe
-
C:\ProgramData\b0zjyDTDj3.exe
-
C:\Users\Admin\AppData\Local\Temp\mm
-
C:\Users\Admin\AppData\Local\Temp\tmpCB49.tmp
-
C:\Users\Admin\AppData\Local\Temp\xx
-
C:\programdata\asc.txt:script1.vbs
-
C:\programdata\b0zjyDTDj3.exe
-
memory/272-3-0x00000000004BB000-0x00000000004C0000-memory.dmpFilesize
20KB
-
memory/1076-18-0x0000000000000000-0x0000000000000000-disk.dmp
-
memory/1076-12-0x0000000000000000-mapping.dmp
-
memory/1692-0-0x0000000000000000-mapping.dmp
-
memory/1748-7-0x0000000000000000-mapping.dmp
-
memory/1764-9-0x0000000002710000-0x0000000002714000-memory.dmpFilesize
16KB
-
memory/1764-2-0x0000000000000000-mapping.dmp
-
memory/1792-19-0x0000000000000000-mapping.dmp
-
memory/1856-10-0x0000000000000000-mapping.dmp
-
memory/1856-15-0x0000000002790000-0x0000000002794000-memory.dmpFilesize
16KB
-
memory/1900-21-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/1900-22-0x000000000044582E-mapping.dmp
-
memory/1900-24-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/1900-25-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/1916-8-0x0000000000000000-mapping.dmp
-
memory/1916-14-0x0000000002560000-0x0000000002564000-memory.dmpFilesize
16KB