Analysis
-
max time kernel
141s -
max time network
21s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
09-07-2020 04:22
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order 24432 .xlsx
Resource
win7v200430
Behavioral task
behavioral2
Sample
Purchase Order 24432 .xlsx
Resource
win10
General
-
Target
Purchase Order 24432 .xlsx
-
Size
14KB
-
MD5
d31859fb69340e3d8aee9d8bc98dfed5
-
SHA1
6b31e11e8c43a222bd07cd79273d9013b2137001
-
SHA256
59f1f955f073e2a326d914a15fff168d9c304795270b26bdfb5e1d68d1f96742
-
SHA512
94ac7f4d94f7c78d1e4a3a16f90d251bd7a815949039294b340375b0da5d2515444dc97e2319dbe6849267ee77f73470ff960db599ad6dae67c80e8e84052f00
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
EXCEL.EXEregasms.exepid Process 828 EXCEL.EXE 828 EXCEL.EXE 828 EXCEL.EXE 1952 regasms.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
EQNEDT32.EXEregasms.exedescription pid Process procid_target PID 1524 wrote to memory of 1740 1524 EQNEDT32.EXE 27 PID 1524 wrote to memory of 1740 1524 EQNEDT32.EXE 27 PID 1524 wrote to memory of 1740 1524 EQNEDT32.EXE 27 PID 1524 wrote to memory of 1740 1524 EQNEDT32.EXE 27 PID 1740 wrote to memory of 1916 1740 regasms.exe 31 PID 1740 wrote to memory of 1916 1740 regasms.exe 31 PID 1740 wrote to memory of 1916 1740 regasms.exe 31 PID 1740 wrote to memory of 1916 1740 regasms.exe 31 PID 1740 wrote to memory of 1972 1740 regasms.exe 33 PID 1740 wrote to memory of 1972 1740 regasms.exe 33 PID 1740 wrote to memory of 1972 1740 regasms.exe 33 PID 1740 wrote to memory of 1972 1740 regasms.exe 33 PID 1740 wrote to memory of 1952 1740 regasms.exe 34 PID 1740 wrote to memory of 1952 1740 regasms.exe 34 PID 1740 wrote to memory of 1952 1740 regasms.exe 34 PID 1740 wrote to memory of 1952 1740 regasms.exe 34 PID 1740 wrote to memory of 1952 1740 regasms.exe 34 PID 1740 wrote to memory of 1952 1740 regasms.exe 34 PID 1740 wrote to memory of 1952 1740 regasms.exe 34 PID 1740 wrote to memory of 1952 1740 regasms.exe 34 PID 1740 wrote to memory of 1952 1740 regasms.exe 34 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
regasms.exedescription pid Process procid_target PID 1740 set thread context of 1952 1740 regasms.exe 34 -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
regasms.exeregasms.exedescription pid Process Token: SeDebugPrivilege 1740 regasms.exe Token: SeDebugPrivilege 1952 regasms.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid Process 828 EXCEL.EXE -
Adds Run entry to start application 2 TTPs 1 IoCs
Processes:
regasms.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run\Officex = "C:\\Users\\Admin\\AppData\\Roaming\\Officex\\Officex.exe" regasms.exe -
Blacklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid Process 4 1524 EQNEDT32.EXE -
Loads dropped DLL 1 IoCs
Processes:
EQNEDT32.EXEpid Process 1524 EQNEDT32.EXE -
Executes dropped EXE 3 IoCs
Processes:
regasms.exeregasms.exeregasms.exepid Process 1740 regasms.exe 1972 regasms.exe 1952 regasms.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
regasms.exeregasms.exepid Process 1740 regasms.exe 1740 regasms.exe 1740 regasms.exe 1952 regasms.exe 1952 regasms.exe -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes
-
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\Purchase Order 24432 .xlsx"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
PID:828
-
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Suspicious use of WriteProcessMemory
- Blacklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
PID:1524 -
C:\Users\Admin\AppData\Roaming\regasms.exeC:\Users\Admin\AppData\Roaming\regasms.exe2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1740 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jlTYJmXxtezeDi" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFE6A.tmp"3⤵
- Creates scheduled task(s)
PID:1916
-
-
C:\Users\Admin\AppData\Roaming\regasms.exe"{path}"3⤵
- Executes dropped EXE
PID:1972
-
-
C:\Users\Admin\AppData\Roaming\regasms.exe"{path}"3⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of AdjustPrivilegeToken
- Adds Run entry to start application
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1952
-
-