Resubmissions
09/07/2020, 13:57
200709-445cetj79s 809/07/2020, 12:35
200709-7gqm8v1jxx 809/07/2020, 12:10
200709-c19gdlgcd2 8Analysis
-
max time kernel
280s -
max time network
300s -
platform
windows10_x64 -
resource
win10 -
submitted
09/07/2020, 13:57
Static task
static1
General
-
Target
9918_99_274.xls
-
Size
159KB
-
MD5
a1e13e4954b98e6524d47527be441812
-
SHA1
72e88bd0543152b638f804548a09c865aa4610c9
-
SHA256
8dd8d863b51d13fedf887fc68e6f7c1a4d93fa868cf0ced1f46d2fca77585e5d
-
SHA512
2734387aa21327b3d6547acb07e4bbf48cb473844e6491f7e659f996dab664a26a8c41cf9b8727e43f770093e7b6c3914db375a36555e32f7564bae02e3673c9
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 151 IoCs
description pid Process procid_target PID 1488 wrote to memory of 2000 1488 firefox.exe 77 PID 1488 wrote to memory of 2000 1488 firefox.exe 77 PID 1488 wrote to memory of 2000 1488 firefox.exe 77 PID 1488 wrote to memory of 2000 1488 firefox.exe 77 PID 1488 wrote to memory of 2000 1488 firefox.exe 77 PID 1488 wrote to memory of 2000 1488 firefox.exe 77 PID 1488 wrote to memory of 2000 1488 firefox.exe 77 PID 1488 wrote to memory of 2000 1488 firefox.exe 77 PID 1488 wrote to memory of 2000 1488 firefox.exe 77 PID 3624 wrote to memory of 3628 3624 firefox.exe 80 PID 3624 wrote to memory of 3628 3624 firefox.exe 80 PID 3624 wrote to memory of 3628 3624 firefox.exe 80 PID 3624 wrote to memory of 3628 3624 firefox.exe 80 PID 3624 wrote to memory of 3628 3624 firefox.exe 80 PID 3624 wrote to memory of 3628 3624 firefox.exe 80 PID 3624 wrote to memory of 3628 3624 firefox.exe 80 PID 3624 wrote to memory of 3628 3624 firefox.exe 80 PID 3624 wrote to memory of 3628 3624 firefox.exe 80 PID 3628 wrote to memory of 3500 3628 firefox.exe 81 PID 3628 wrote to memory of 3500 3628 firefox.exe 81 PID 2000 wrote to memory of 3040 2000 firefox.exe 82 PID 2000 wrote to memory of 3040 2000 firefox.exe 82 PID 2000 wrote to memory of 1924 2000 firefox.exe 85 PID 2000 wrote to memory of 1924 2000 firefox.exe 85 PID 2000 wrote to memory of 1924 2000 firefox.exe 85 PID 2000 wrote to memory of 1924 2000 firefox.exe 85 PID 2000 wrote to memory of 1924 2000 firefox.exe 85 PID 2000 wrote to memory of 1924 2000 firefox.exe 85 PID 2000 wrote to memory of 1924 2000 firefox.exe 85 PID 2000 wrote to memory of 1924 2000 firefox.exe 85 PID 2000 wrote to memory of 1924 2000 firefox.exe 85 PID 2000 wrote to memory of 1924 2000 firefox.exe 85 PID 2000 wrote to memory of 1924 2000 firefox.exe 85 PID 2000 wrote to memory of 1924 2000 firefox.exe 85 PID 2000 wrote to memory of 1924 2000 firefox.exe 85 PID 2000 wrote to memory of 1924 2000 firefox.exe 85 PID 2000 wrote to memory of 1924 2000 firefox.exe 85 PID 2000 wrote to memory of 1924 2000 firefox.exe 85 PID 2000 wrote to memory of 1924 2000 firefox.exe 85 PID 2000 wrote to memory of 1924 2000 firefox.exe 85 PID 2000 wrote to memory of 1924 2000 firefox.exe 85 PID 2000 wrote to memory of 1924 2000 firefox.exe 85 PID 2000 wrote to memory of 1924 2000 firefox.exe 85 PID 2000 wrote to memory of 1924 2000 firefox.exe 85 PID 2000 wrote to memory of 1924 2000 firefox.exe 85 PID 2000 wrote to memory of 1924 2000 firefox.exe 85 PID 2000 wrote to memory of 1924 2000 firefox.exe 85 PID 2000 wrote to memory of 1924 2000 firefox.exe 85 PID 2000 wrote to memory of 1924 2000 firefox.exe 85 PID 2000 wrote to memory of 1924 2000 firefox.exe 85 PID 2000 wrote to memory of 1924 2000 firefox.exe 85 PID 2000 wrote to memory of 1924 2000 firefox.exe 85 PID 2000 wrote to memory of 1924 2000 firefox.exe 85 PID 2000 wrote to memory of 1924 2000 firefox.exe 85 PID 2000 wrote to memory of 1924 2000 firefox.exe 85 PID 2000 wrote to memory of 1924 2000 firefox.exe 85 PID 2000 wrote to memory of 1924 2000 firefox.exe 85 PID 2000 wrote to memory of 1924 2000 firefox.exe 85 PID 2000 wrote to memory of 1924 2000 firefox.exe 85 PID 2000 wrote to memory of 1924 2000 firefox.exe 85 PID 2000 wrote to memory of 1924 2000 firefox.exe 85 PID 2000 wrote to memory of 1924 2000 firefox.exe 85 PID 2000 wrote to memory of 1924 2000 firefox.exe 85 PID 2000 wrote to memory of 1924 2000 firefox.exe 85 PID 2000 wrote to memory of 1924 2000 firefox.exe 85 PID 2000 wrote to memory of 504 2000 firefox.exe 86 PID 2000 wrote to memory of 504 2000 firefox.exe 86 PID 2000 wrote to memory of 504 2000 firefox.exe 86 PID 2000 wrote to memory of 504 2000 firefox.exe 86 PID 2000 wrote to memory of 504 2000 firefox.exe 86 PID 2000 wrote to memory of 504 2000 firefox.exe 86 PID 2000 wrote to memory of 504 2000 firefox.exe 86 PID 2000 wrote to memory of 504 2000 firefox.exe 86 PID 2000 wrote to memory of 504 2000 firefox.exe 86 PID 2000 wrote to memory of 504 2000 firefox.exe 86 PID 2000 wrote to memory of 504 2000 firefox.exe 86 PID 2000 wrote to memory of 504 2000 firefox.exe 86 PID 2000 wrote to memory of 504 2000 firefox.exe 86 PID 2000 wrote to memory of 504 2000 firefox.exe 86 PID 2000 wrote to memory of 504 2000 firefox.exe 86 PID 2000 wrote to memory of 504 2000 firefox.exe 86 PID 2000 wrote to memory of 504 2000 firefox.exe 86 PID 2000 wrote to memory of 504 2000 firefox.exe 86 PID 2000 wrote to memory of 504 2000 firefox.exe 86 PID 2000 wrote to memory of 504 2000 firefox.exe 86 PID 2000 wrote to memory of 504 2000 firefox.exe 86 PID 2000 wrote to memory of 504 2000 firefox.exe 86 PID 2000 wrote to memory of 504 2000 firefox.exe 86 PID 2000 wrote to memory of 504 2000 firefox.exe 86 PID 2000 wrote to memory of 504 2000 firefox.exe 86 PID 2000 wrote to memory of 504 2000 firefox.exe 86 PID 2000 wrote to memory of 504 2000 firefox.exe 86 PID 2000 wrote to memory of 504 2000 firefox.exe 86 PID 2000 wrote to memory of 504 2000 firefox.exe 86 PID 2000 wrote to memory of 504 2000 firefox.exe 86 PID 2000 wrote to memory of 504 2000 firefox.exe 86 PID 2000 wrote to memory of 504 2000 firefox.exe 86 PID 2000 wrote to memory of 504 2000 firefox.exe 86 PID 2000 wrote to memory of 504 2000 firefox.exe 86 PID 2000 wrote to memory of 504 2000 firefox.exe 86 PID 2000 wrote to memory of 504 2000 firefox.exe 86 PID 2000 wrote to memory of 504 2000 firefox.exe 86 PID 2000 wrote to memory of 504 2000 firefox.exe 86 PID 2000 wrote to memory of 504 2000 firefox.exe 86 PID 2000 wrote to memory of 504 2000 firefox.exe 86 PID 2000 wrote to memory of 504 2000 firefox.exe 86 PID 2000 wrote to memory of 504 2000 firefox.exe 86 PID 2000 wrote to memory of 504 2000 firefox.exe 86 PID 2000 wrote to memory of 4576 2000 firefox.exe 89 PID 2000 wrote to memory of 4576 2000 firefox.exe 89 PID 2000 wrote to memory of 4576 2000 firefox.exe 89 PID 2000 wrote to memory of 4576 2000 firefox.exe 89 PID 2000 wrote to memory of 4576 2000 firefox.exe 89 PID 2000 wrote to memory of 4576 2000 firefox.exe 89 PID 2000 wrote to memory of 4576 2000 firefox.exe 89 PID 2000 wrote to memory of 4576 2000 firefox.exe 89 PID 2000 wrote to memory of 4576 2000 firefox.exe 89 PID 2000 wrote to memory of 4576 2000 firefox.exe 89 PID 2000 wrote to memory of 4576 2000 firefox.exe 89 PID 2000 wrote to memory of 4576 2000 firefox.exe 89 PID 2000 wrote to memory of 4576 2000 firefox.exe 89 PID 2000 wrote to memory of 4576 2000 firefox.exe 89 PID 2000 wrote to memory of 4576 2000 firefox.exe 89 PID 2000 wrote to memory of 4576 2000 firefox.exe 89 PID 2000 wrote to memory of 4576 2000 firefox.exe 89 PID 2000 wrote to memory of 4576 2000 firefox.exe 89 PID 2000 wrote to memory of 4576 2000 firefox.exe 89 PID 2000 wrote to memory of 4576 2000 firefox.exe 89 PID 2000 wrote to memory of 4576 2000 firefox.exe 89 PID 2000 wrote to memory of 4576 2000 firefox.exe 89 PID 2000 wrote to memory of 4576 2000 firefox.exe 89 PID 2000 wrote to memory of 4576 2000 firefox.exe 89 PID 2000 wrote to memory of 4576 2000 firefox.exe 89 PID 2000 wrote to memory of 4576 2000 firefox.exe 89 PID 2000 wrote to memory of 4576 2000 firefox.exe 89 PID 2000 wrote to memory of 4576 2000 firefox.exe 89 PID 2000 wrote to memory of 4576 2000 firefox.exe 89 PID 2000 wrote to memory of 4576 2000 firefox.exe 89 PID 2000 wrote to memory of 4576 2000 firefox.exe 89 PID 2000 wrote to memory of 4576 2000 firefox.exe 89 PID 2000 wrote to memory of 4576 2000 firefox.exe 89 PID 2000 wrote to memory of 4576 2000 firefox.exe 89 PID 2000 wrote to memory of 4576 2000 firefox.exe 89 PID 2000 wrote to memory of 4576 2000 firefox.exe 89 PID 2000 wrote to memory of 4576 2000 firefox.exe 89 PID 2000 wrote to memory of 4576 2000 firefox.exe 89 PID 2000 wrote to memory of 4576 2000 firefox.exe 89 PID 2000 wrote to memory of 4576 2000 firefox.exe 89 PID 2000 wrote to memory of 4576 2000 firefox.exe 89 PID 2000 wrote to memory of 4576 2000 firefox.exe 89 PID 2000 wrote to memory of 4576 2000 firefox.exe 89 -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 2000 firefox.exe 2000 firefox.exe 2000 firefox.exe 2000 firefox.exe -
Enumerates connected drives 3 TTPs
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA firefox.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings firefox.exe -
Suspicious use of SetWindowsHookEx 17 IoCs
pid Process 3100 EXCEL.EXE 3100 EXCEL.EXE 3100 EXCEL.EXE 3100 EXCEL.EXE 3100 EXCEL.EXE 3100 EXCEL.EXE 3100 EXCEL.EXE 3100 EXCEL.EXE 3100 EXCEL.EXE 3100 EXCEL.EXE 3100 EXCEL.EXE 3100 EXCEL.EXE 3100 EXCEL.EXE 3100 EXCEL.EXE 3100 EXCEL.EXE 3628 firefox.exe 2000 firefox.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3100 EXCEL.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks processor information in registry 2 TTPs 11 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b06010505070308060a2b0601040182370a030406082b0601050507030606082b0601050507030106082b0601050507030706082b0601050507030206082b0601050507030406082b0601050507030353000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e EXCEL.EXE -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 2000 firefox.exe 2000 firefox.exe 2000 firefox.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2000 firefox.exe Token: SeDebugPrivilege 2000 firefox.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\9918_99_274.xls"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
- Checks processor information in registry
- Enumerates system info in registry
- Modifies system certificate store
PID:3100
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of FindShellTrayWindow
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Checks processor information in registry
- Suspicious use of SendNotifyMessage
- Suspicious use of AdjustPrivilegeToken
PID:2000 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2000.0.757437500\605113895" -parentBuildID 20200403170909 -prefsHandle 1516 -prefMapHandle 1508 -prefsLen 1 -prefMapSize 219808 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2000 "\\.\pipe\gecko-crash-server-pipe.2000" 1616 gpu3⤵PID:3040
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2000.3.1169187500\792849993" -childID 1 -isForBrowser -prefsHandle 2256 -prefMapHandle 2252 -prefsLen 501 -prefMapSize 219808 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2000 "\\.\pipe\gecko-crash-server-pipe.2000" 2128 tab3⤵PID:1924
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2000.13.47469765\1599752177" -childID 2 -isForBrowser -prefsHandle 3300 -prefMapHandle 3264 -prefsLen 1368 -prefMapSize 219808 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2000 "\\.\pipe\gecko-crash-server-pipe.2000" 2588 tab3⤵PID:504
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2000.20.306482924\519935551" -childID 3 -isForBrowser -prefsHandle 3612 -prefMapHandle 3608 -prefsLen 7430 -prefMapSize 219808 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2000 "\\.\pipe\gecko-crash-server-pipe.2000" 3624 tab3⤵PID:4576
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
- Checks processor information in registry
PID:3628 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3628.0.1684540884\635231775" -parentBuildID 20200403170909 -prefsHandle 1380 -prefMapHandle 1372 -prefsLen 1 -prefMapSize 214080 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3628 "\\.\pipe\gecko-crash-server-pipe.3628" 1464 gpu3⤵PID:3500
-
-