Analysis
- max time kernel
138s - max time network
133s - platform
windows10_x64 - resource
win10v200430 - submitted
15/07/2020, 22:54
Static task
static1
Behavioral task
behavioral1
Sample
in_0.xls
Resource
win7
windows7_x64
0 signatures
0 seconds
General
- Target in_0.xls
- Size 90KB
- Sample200715-cndler9nws
- SHA256 270c390e3881b58882389e9c87b60115166a833eb2c1c5f9ad1d660a50f517a9
- MD5 b0beb28b535080c00fc2f628f00c4499
- SHA1 f15eb3581647623e661c11c7ace8a02a0fda3c24
- SHA512 b700aad4aaea481af32cf50441008d5faf27085c9e1acd6206fc958444876e77f405b356d5c167f52f5755270d918577b82b68149a3ddc102b7fd5aab3307977
- MD5 SHA1 SHA512
Malware Config
Signatures
- Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2564 wrote to memory of 3472 2564 EXCEL.EXE 74 PID 2564 wrote to memory of 3472 2564 EXCEL.EXE 74 PID 3472 wrote to memory of 1748 3472 regsvr32.exe 75 PID 3472 wrote to memory of 1748 3472 regsvr32.exe 75 PID 3472 wrote to memory of 1748 3472 regsvr32.exe 75 PID 1748 wrote to memory of 3196 1748 regsvr32.exe 77 PID 1748 wrote to memory of 3196 1748 regsvr32.exe 77 PID 1748 wrote to memory of 3196 1748 regsvr32.exe 77 PID 1748 wrote to memory of 3196 1748 regsvr32.exe 77 PID 1748 wrote to memory of 3196 1748 regsvr32.exe 77 PID 3196 wrote to memory of 3744 3196 svchost.exe 78 PID 3196 wrote to memory of 3744 3196 svchost.exe 78 PID 3196 wrote to memory of 3744 3196 svchost.exe 78 PID 3196 wrote to memory of 1000 3196 svchost.exe 80 PID 3196 wrote to memory of 1000 3196 svchost.exe 80 PID 3196 wrote to memory of 1000 3196 svchost.exe 80 PID 3196 wrote to memory of 1000 3196 svchost.exe 80 PID 3196 wrote to memory of 1000 3196 svchost.exe 80 - Suspicious behavior: EnumeratesProcesses 19 IoCs
pid Process 3196 svchost.exe 3196 svchost.exe 3196 svchost.exe 3196 svchost.exe 3616 WerFault.exe 3616 WerFault.exe 3616 WerFault.exe 3616 WerFault.exe 3616 WerFault.exe 3616 WerFault.exe 3616 WerFault.exe 3616 WerFault.exe 3616 WerFault.exe 3616 WerFault.exe 3616 WerFault.exe 3616 WerFault.exe 3616 WerFault.exe 3616 WerFault.exe 3616 WerFault.exe - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 24 api.ipify.org - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2564 EXCEL.EXE 2564 EXCEL.EXE 2564 EXCEL.EXE 2564 EXCEL.EXE 2564 EXCEL.EXE 2564 EXCEL.EXE 2564 EXCEL.EXE 2564 EXCEL.EXE 2564 EXCEL.EXE 2564 EXCEL.EXE 2564 EXCEL.EXE 2564 EXCEL.EXE - Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3472 2564 regsvr32.exe 65 - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2564 EXCEL.EXE - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1748 set thread context of 3196 1748 regsvr32.exe 77 PID 3196 set thread context of 1000 3196 svchost.exe 80 - Program crash 1 IoCs
pid pid_target Process procid_target 3616 1748 WerFault.exe 75 - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE - Loads dropped DLL 1 IoCs
pid Process 1748 regsvr32.exe - Suspicious use of AdjustPrivilegeToken 67 IoCs
description pid Process Token: SeImpersonatePrivilege 3196 svchost.exe Token: SeTcbPrivilege 3196 svchost.exe Token: SeChangeNotifyPrivilege 3196 svchost.exe Token: SeCreateTokenPrivilege 3196 svchost.exe Token: SeBackupPrivilege 3196 svchost.exe Token: SeRestorePrivilege 3196 svchost.exe Token: SeIncreaseQuotaPrivilege 3196 svchost.exe Token: SeAssignPrimaryTokenPrivilege 3196 svchost.exe Token: SeImpersonatePrivilege 3196 svchost.exe Token: SeTcbPrivilege 3196 svchost.exe Token: SeChangeNotifyPrivilege 3196 svchost.exe Token: SeCreateTokenPrivilege 3196 svchost.exe Token: SeBackupPrivilege 3196 svchost.exe Token: SeRestorePrivilege 3196 svchost.exe Token: SeIncreaseQuotaPrivilege 3196 svchost.exe Token: SeAssignPrimaryTokenPrivilege 3196 svchost.exe Token: SeImpersonatePrivilege 3196 svchost.exe Token: SeTcbPrivilege 3196 svchost.exe Token: SeChangeNotifyPrivilege 3196 svchost.exe Token: SeCreateTokenPrivilege 3196 svchost.exe Token: SeBackupPrivilege 3196 svchost.exe Token: SeRestorePrivilege 3196 svchost.exe Token: SeIncreaseQuotaPrivilege 3196 svchost.exe Token: SeAssignPrimaryTokenPrivilege 3196 svchost.exe Token: SeImpersonatePrivilege 3196 svchost.exe Token: SeTcbPrivilege 3196 svchost.exe Token: SeChangeNotifyPrivilege 3196 svchost.exe Token: SeCreateTokenPrivilege 3196 svchost.exe Token: SeBackupPrivilege 3196 svchost.exe Token: SeRestorePrivilege 3196 svchost.exe Token: SeIncreaseQuotaPrivilege 3196 svchost.exe Token: SeAssignPrimaryTokenPrivilege 3196 svchost.exe Token: SeImpersonatePrivilege 3196 svchost.exe Token: SeTcbPrivilege 3196 svchost.exe Token: SeChangeNotifyPrivilege 3196 svchost.exe Token: SeCreateTokenPrivilege 3196 svchost.exe Token: SeBackupPrivilege 3196 svchost.exe Token: SeRestorePrivilege 3196 svchost.exe Token: SeIncreaseQuotaPrivilege 3196 svchost.exe Token: SeAssignPrimaryTokenPrivilege 3196 svchost.exe Token: SeImpersonatePrivilege 1000 svchost.exe Token: SeTcbPrivilege 1000 svchost.exe Token: SeChangeNotifyPrivilege 1000 svchost.exe Token: SeCreateTokenPrivilege 1000 svchost.exe Token: SeBackupPrivilege 1000 svchost.exe Token: SeRestorePrivilege 1000 svchost.exe Token: SeIncreaseQuotaPrivilege 1000 svchost.exe Token: SeAssignPrimaryTokenPrivilege 1000 svchost.exe Token: SeImpersonatePrivilege 1000 svchost.exe Token: SeTcbPrivilege 1000 svchost.exe Token: SeChangeNotifyPrivilege 1000 svchost.exe Token: SeCreateTokenPrivilege 1000 svchost.exe Token: SeBackupPrivilege 1000 svchost.exe Token: SeRestorePrivilege 1000 svchost.exe Token: SeIncreaseQuotaPrivilege 1000 svchost.exe Token: SeAssignPrimaryTokenPrivilege 1000 svchost.exe Token: SeImpersonatePrivilege 1000 svchost.exe Token: SeTcbPrivilege 1000 svchost.exe Token: SeChangeNotifyPrivilege 1000 svchost.exe Token: SeCreateTokenPrivilege 1000 svchost.exe Token: SeBackupPrivilege 1000 svchost.exe Token: SeRestorePrivilege 1000 svchost.exe Token: SeIncreaseQuotaPrivilege 1000 svchost.exe Token: SeAssignPrimaryTokenPrivilege 1000 svchost.exe Token: SeRestorePrivilege 3616 WerFault.exe Token: SeBackupPrivilege 3616 WerFault.exe Token: SeDebugPrivilege 3616 WerFault.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\in_0.xls"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
- Checks processor information in registry
- Suspicious behavior: AddClipboardFormatListener
- Enumerates system info in registry
PID:2564 -
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s /i BvkFvmz.ocx2⤵
- Suspicious use of WriteProcessMemory
- Process spawned unexpected child process
PID:3472 -
C:\Windows\SysWOW64\regsvr32.exe/s /i BvkFvmz.ocx3⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Loads dropped DLL
PID:1748 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\System32\svchost.exe4⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3196 -
C:\Windows\SysWOW64\cmd.execmd /K5⤵PID:3744
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\System32\svchost.exe5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1000
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1748 -s 6644⤵
- Suspicious behavior: EnumeratesProcesses
- Program crash
PID:3616
-
-
-