Analysis
-
max time kernel
137s -
max time network
149s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
15/07/2020, 22:56
Static task
static1
Behavioral task
behavioral1
Sample
in_9.xls
Resource
win7
windows7_x64
0 signatures
0 seconds
General
-
Target
in_9.xls
-
Size
90KB
-
MD5
b569a368d36af422cf9c32656b3210ae
-
SHA1
0db43b4b6e1da2923cdafc4e21fd3054942f240c
-
SHA256
ea597641de8a19fd57c2873cc9f87e1f39c68b6ce56b471804e458a92ad19297
-
SHA512
ae269e82b06c9fe3b3ac275611d961ba1bedda4416e49f778896282b65120e760c9462d3327279fbb448f2f2e32cc27951152aed109c2a7d1fe83197cc8f867b
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 1100 regsvr32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 3372 1100 WerFault.exe 76 -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1100 set thread context of 3800 1100 regsvr32.exe 78 PID 3800 set thread context of 1112 3800 svchost.exe 81 -
Suspicious behavior: EnumeratesProcesses 19 IoCs
pid Process 3800 svchost.exe 3800 svchost.exe 3800 svchost.exe 3800 svchost.exe 3372 WerFault.exe 3372 WerFault.exe 3372 WerFault.exe 3372 WerFault.exe 3372 WerFault.exe 3372 WerFault.exe 3372 WerFault.exe 3372 WerFault.exe 3372 WerFault.exe 3372 WerFault.exe 3372 WerFault.exe 3372 WerFault.exe 3372 WerFault.exe 3372 WerFault.exe 3372 WerFault.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 1612 EXCEL.EXE 1612 EXCEL.EXE 1612 EXCEL.EXE 1612 EXCEL.EXE 1612 EXCEL.EXE 1612 EXCEL.EXE 1612 EXCEL.EXE 1612 EXCEL.EXE 1612 EXCEL.EXE 1612 EXCEL.EXE 1612 EXCEL.EXE 1612 EXCEL.EXE -
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 2968 1612 regsvr32.exe 67 -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1612 wrote to memory of 2968 1612 EXCEL.EXE 75 PID 1612 wrote to memory of 2968 1612 EXCEL.EXE 75 PID 2968 wrote to memory of 1100 2968 regsvr32.exe 76 PID 2968 wrote to memory of 1100 2968 regsvr32.exe 76 PID 2968 wrote to memory of 1100 2968 regsvr32.exe 76 PID 1100 wrote to memory of 3800 1100 regsvr32.exe 78 PID 1100 wrote to memory of 3800 1100 regsvr32.exe 78 PID 1100 wrote to memory of 3800 1100 regsvr32.exe 78 PID 1100 wrote to memory of 3800 1100 regsvr32.exe 78 PID 1100 wrote to memory of 3800 1100 regsvr32.exe 78 PID 3800 wrote to memory of 3740 3800 svchost.exe 79 PID 3800 wrote to memory of 3740 3800 svchost.exe 79 PID 3800 wrote to memory of 3740 3800 svchost.exe 79 PID 3800 wrote to memory of 1112 3800 svchost.exe 81 PID 3800 wrote to memory of 1112 3800 svchost.exe 81 PID 3800 wrote to memory of 1112 3800 svchost.exe 81 PID 3800 wrote to memory of 1112 3800 svchost.exe 81 PID 3800 wrote to memory of 1112 3800 svchost.exe 81 -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 25 api.ipify.org -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1612 EXCEL.EXE -
Suspicious use of AdjustPrivilegeToken 67 IoCs
description pid Process Token: SeImpersonatePrivilege 3800 svchost.exe Token: SeTcbPrivilege 3800 svchost.exe Token: SeChangeNotifyPrivilege 3800 svchost.exe Token: SeCreateTokenPrivilege 3800 svchost.exe Token: SeBackupPrivilege 3800 svchost.exe Token: SeRestorePrivilege 3800 svchost.exe Token: SeIncreaseQuotaPrivilege 3800 svchost.exe Token: SeAssignPrimaryTokenPrivilege 3800 svchost.exe Token: SeImpersonatePrivilege 3800 svchost.exe Token: SeTcbPrivilege 3800 svchost.exe Token: SeChangeNotifyPrivilege 3800 svchost.exe Token: SeCreateTokenPrivilege 3800 svchost.exe Token: SeBackupPrivilege 3800 svchost.exe Token: SeRestorePrivilege 3800 svchost.exe Token: SeIncreaseQuotaPrivilege 3800 svchost.exe Token: SeAssignPrimaryTokenPrivilege 3800 svchost.exe Token: SeImpersonatePrivilege 3800 svchost.exe Token: SeTcbPrivilege 3800 svchost.exe Token: SeChangeNotifyPrivilege 3800 svchost.exe Token: SeCreateTokenPrivilege 3800 svchost.exe Token: SeBackupPrivilege 3800 svchost.exe Token: SeRestorePrivilege 3800 svchost.exe Token: SeIncreaseQuotaPrivilege 3800 svchost.exe Token: SeAssignPrimaryTokenPrivilege 3800 svchost.exe Token: SeImpersonatePrivilege 3800 svchost.exe Token: SeTcbPrivilege 3800 svchost.exe Token: SeChangeNotifyPrivilege 3800 svchost.exe Token: SeCreateTokenPrivilege 3800 svchost.exe Token: SeBackupPrivilege 3800 svchost.exe Token: SeRestorePrivilege 3800 svchost.exe Token: SeIncreaseQuotaPrivilege 3800 svchost.exe Token: SeAssignPrimaryTokenPrivilege 3800 svchost.exe Token: SeImpersonatePrivilege 3800 svchost.exe Token: SeTcbPrivilege 3800 svchost.exe Token: SeChangeNotifyPrivilege 3800 svchost.exe Token: SeCreateTokenPrivilege 3800 svchost.exe Token: SeBackupPrivilege 3800 svchost.exe Token: SeRestorePrivilege 3800 svchost.exe Token: SeIncreaseQuotaPrivilege 3800 svchost.exe Token: SeAssignPrimaryTokenPrivilege 3800 svchost.exe Token: SeImpersonatePrivilege 1112 svchost.exe Token: SeTcbPrivilege 1112 svchost.exe Token: SeChangeNotifyPrivilege 1112 svchost.exe Token: SeCreateTokenPrivilege 1112 svchost.exe Token: SeBackupPrivilege 1112 svchost.exe Token: SeRestorePrivilege 1112 svchost.exe Token: SeIncreaseQuotaPrivilege 1112 svchost.exe Token: SeAssignPrimaryTokenPrivilege 1112 svchost.exe Token: SeImpersonatePrivilege 1112 svchost.exe Token: SeTcbPrivilege 1112 svchost.exe Token: SeChangeNotifyPrivilege 1112 svchost.exe Token: SeCreateTokenPrivilege 1112 svchost.exe Token: SeBackupPrivilege 1112 svchost.exe Token: SeRestorePrivilege 1112 svchost.exe Token: SeIncreaseQuotaPrivilege 1112 svchost.exe Token: SeAssignPrimaryTokenPrivilege 1112 svchost.exe Token: SeImpersonatePrivilege 1112 svchost.exe Token: SeTcbPrivilege 1112 svchost.exe Token: SeChangeNotifyPrivilege 1112 svchost.exe Token: SeCreateTokenPrivilege 1112 svchost.exe Token: SeBackupPrivilege 1112 svchost.exe Token: SeRestorePrivilege 1112 svchost.exe Token: SeIncreaseQuotaPrivilege 1112 svchost.exe Token: SeAssignPrimaryTokenPrivilege 1112 svchost.exe Token: SeRestorePrivilege 3372 WerFault.exe Token: SeBackupPrivilege 3372 WerFault.exe Token: SeDebugPrivilege 3372 WerFault.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\in_9.xls"1⤵
- Enumerates system info in registry
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Suspicious behavior: AddClipboardFormatListener
PID:1612 -
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s /i BvkFvmz.ocx2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\SysWOW64\regsvr32.exe/s /i BvkFvmz.ocx3⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\System32\svchost.exe4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:3800 -
C:\Windows\SysWOW64\cmd.execmd /K5⤵PID:3740
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\System32\svchost.exe5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1112
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 6684⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
PID:3372
-
-
-