1943b72d34dbaf3abb226d62d68a4d27fe012c8a978ef1d32e393172d4b201d7

Analysis

max time kernel
150s
max time network
81s
platform
windows7_x64
resource
win7v200430
submitted
13-07-2020 14:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

674457.xlsm
Size

48KB
MD5

7dea468f495bfad5b8eacb2abe0ecd27
SHA1

9da52def8e221d8e9d394931e77fd5441930f351
SHA256

1943b72d34dbaf3abb226d62d68a4d27fe012c8a978ef1d32e393172d4b201d7
SHA512

9658a234116bbc5ac22a9b6c26d8a73c9b133cc51716f8f6bf2ec36f021f4d6b60fe5734942099ba1c78ecb74176b7f47985d792396bf7e317c891d582f12169

Score

10^/10

spyware

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1016	16hDd9iAu.exe
Token: SeDebugPrivilege	1496	16hDd9iAu.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Script User-Agent 2 IoCs

description	flow	ioc
HTTP User-Agent header	2	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	1	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
892	EXCEL.EXE
892	EXCEL.EXE
892	EXCEL.EXE
1496	16hDd9iAu.exe

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1696	892	cscript.exe	23

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1016 set thread context of 1496	1016	16hDd9iAu.exe	39

Blacklisted process makes network request 2 IoCs

flow	pid	Process
1	1696	cscript.exe
2	1220	cscript.exe

Executes dropped EXE 2 IoCs

pid	Process
1016	16hDd9iAu.exe
1496	16hDd9iAu.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1576	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1016	16hDd9iAu.exe
1496	16hDd9iAu.exe
1496	16hDd9iAu.exe

Launches Equation Editor 1 TTPs 1 IoCs

Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

exploit

Exploitation for Client Execution

T1203

pid	Process
1516	EQNEDT32.EXE

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\programdata\asc.txt:script1.vbs	EXCEL.EXE

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
892	EXCEL.EXE

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 888	1516	EQNEDT32.EXE	25
PID 1516 wrote to memory of 888	1516	EQNEDT32.EXE	25
PID 1516 wrote to memory of 888	1516	EQNEDT32.EXE	25
PID 1516 wrote to memory of 888	1516	EQNEDT32.EXE	25
PID 888 wrote to memory of 736	888	cmd.exe	27
PID 888 wrote to memory of 736	888	cmd.exe	27
PID 888 wrote to memory of 736	888	cmd.exe	27
PID 888 wrote to memory of 736	888	cmd.exe	27
PID 892 wrote to memory of 1696	892	EXCEL.EXE	28
PID 892 wrote to memory of 1696	892	EXCEL.EXE	28
PID 892 wrote to memory of 1696	892	EXCEL.EXE	28
PID 736 wrote to memory of 1768	736	cscript.exe	31
PID 736 wrote to memory of 1768	736	cscript.exe	31
PID 736 wrote to memory of 1768	736	cscript.exe	31
PID 736 wrote to memory of 1768	736	cscript.exe	31
PID 1768 wrote to memory of 1220	1768	cmd.exe	33
PID 1768 wrote to memory of 1220	1768	cmd.exe	33
PID 1768 wrote to memory of 1220	1768	cmd.exe	33
PID 1768 wrote to memory of 1220	1768	cmd.exe	33
PID 1696 wrote to memory of 1016	1696	cscript.exe	34
PID 1696 wrote to memory of 1016	1696	cscript.exe	34
PID 1696 wrote to memory of 1016	1696	cscript.exe	34
PID 1696 wrote to memory of 1016	1696	cscript.exe	34
PID 1016 wrote to memory of 1576	1016	16hDd9iAu.exe	37
PID 1016 wrote to memory of 1576	1016	16hDd9iAu.exe	37
PID 1016 wrote to memory of 1576	1016	16hDd9iAu.exe	37
PID 1016 wrote to memory of 1576	1016	16hDd9iAu.exe	37
PID 1016 wrote to memory of 1496	1016	16hDd9iAu.exe	39
PID 1016 wrote to memory of 1496	1016	16hDd9iAu.exe	39
PID 1016 wrote to memory of 1496	1016	16hDd9iAu.exe	39
PID 1016 wrote to memory of 1496	1016	16hDd9iAu.exe	39
PID 1016 wrote to memory of 1496	1016	16hDd9iAu.exe	39
PID 1016 wrote to memory of 1496	1016	16hDd9iAu.exe	39
PID 1016 wrote to memory of 1496	1016	16hDd9iAu.exe	39
PID 1016 wrote to memory of 1496	1016	16hDd9iAu.exe	39
PID 1016 wrote to memory of 1496	1016	16hDd9iAu.exe	39

Office loads VBA resources, possible macro or embedded object present

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\674457.xlsm
1⤵
- Suspicious use of SetWindowsHookEx
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
PID:892
- C:\Windows\system32\cscript.exe
  "C:\Windows\system32\cscript.exe" C:\programdata\asc.txt:script1.vbs
  2⤵
  - Process spawned unexpected child process
  - Blacklisted process makes network request
  - Suspicious use of WriteProcessMemory
  PID:1696
- - C:\programdata\16hDd9iAu.exe
    C:\programdata\16hDd9iAu.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetThreadContext
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1016
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kotmNnXRsX" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD69F.tmp"
      4⤵
      Creates scheduled task(s)
      PID:1576
  - - C:\programdata\16hDd9iAu.exe
      "{path}"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1496

C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
1⤵
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ren %tmp%\mm v&cScriPT %tmp%\v?..wsf C
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:888
- - C:\Windows\SysWOW64\cscript.exe
    cScriPT C:\Users\Admin\AppData\Local\Temp\v?..wsf C
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:736
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c cscript C:\Users\Admin\AppData\Local\Temp\xx.vbs
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1768
    - - C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp\xx.vbs
        5⤵
        Blacklisted process makes network request
        
        PID:1220

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Exploitation for Client Execution

T1203

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/736-9-0x0000000002880000-0x0000000002884000-memory.dmp

Filesize
16KB

Download
memory/1220-15-0x00000000027C0000-0x00000000027C4000-memory.dmp

Filesize
16KB

Download
memory/1496-24-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1496-23-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1496-20-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1696-13-0x0000000002530000-0x0000000002534000-memory.dmp

Filesize
16KB

Download