Analysis
- max time kernel
135s - max time network
143s - platform
windows10_x64 - resource
win10 - submitted
15/07/2020, 19:36
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.DOC.Kryptik.Q.14432.xls
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
General
- Target SecuriteInfo.com.DOC.Kryptik.Q.14432.xls
- Size 90KB
- Sample200715-elkh93mf8s
- SHA256 fb1df2bf596883d3cb6d0bce87b69fb31db842de3a3480b8b0a997be420ff4f1
- MD5 55d65301a639c4bf8849658c44883d2e
- SHA1 65d8b3f810409e19a83fbb5ed3f3fae9f957160f
- SHA512 7909493ee1df356bfcaf3b11acd600aad28b402b6c7c98bbfce5b7871a01ce5bb89718f2b2c5341b13269b19194322485b9d611e84e6f674af601777e7470c98
- MD5 SHA1 SHA512
Malware Config
Signatures
- Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2984 EXCEL.EXE 2984 EXCEL.EXE 2984 EXCEL.EXE 2984 EXCEL.EXE 2984 EXCEL.EXE 2984 EXCEL.EXE 2984 EXCEL.EXE 2984 EXCEL.EXE 2984 EXCEL.EXE 2984 EXCEL.EXE 2984 EXCEL.EXE 2984 EXCEL.EXE - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE - Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 632 2984 regsvr32.exe 66 - Suspicious behavior: EnumeratesProcesses 19 IoCs
pid Process 1568 svchost.exe 1568 svchost.exe 1568 svchost.exe 1568 svchost.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe - Suspicious use of AdjustPrivilegeToken 67 IoCs
description pid Process Token: SeImpersonatePrivilege 1568 svchost.exe Token: SeTcbPrivilege 1568 svchost.exe Token: SeChangeNotifyPrivilege 1568 svchost.exe Token: SeCreateTokenPrivilege 1568 svchost.exe Token: SeBackupPrivilege 1568 svchost.exe Token: SeRestorePrivilege 1568 svchost.exe Token: SeIncreaseQuotaPrivilege 1568 svchost.exe Token: SeAssignPrimaryTokenPrivilege 1568 svchost.exe Token: SeImpersonatePrivilege 1568 svchost.exe Token: SeTcbPrivilege 1568 svchost.exe Token: SeChangeNotifyPrivilege 1568 svchost.exe Token: SeCreateTokenPrivilege 1568 svchost.exe Token: SeBackupPrivilege 1568 svchost.exe Token: SeRestorePrivilege 1568 svchost.exe Token: SeIncreaseQuotaPrivilege 1568 svchost.exe Token: SeAssignPrimaryTokenPrivilege 1568 svchost.exe Token: SeImpersonatePrivilege 1568 svchost.exe Token: SeTcbPrivilege 1568 svchost.exe Token: SeChangeNotifyPrivilege 1568 svchost.exe Token: SeCreateTokenPrivilege 1568 svchost.exe Token: SeBackupPrivilege 1568 svchost.exe Token: SeRestorePrivilege 1568 svchost.exe Token: SeIncreaseQuotaPrivilege 1568 svchost.exe Token: SeAssignPrimaryTokenPrivilege 1568 svchost.exe Token: SeImpersonatePrivilege 1568 svchost.exe Token: SeTcbPrivilege 1568 svchost.exe Token: SeChangeNotifyPrivilege 1568 svchost.exe Token: SeCreateTokenPrivilege 1568 svchost.exe Token: SeBackupPrivilege 1568 svchost.exe Token: SeRestorePrivilege 1568 svchost.exe Token: SeIncreaseQuotaPrivilege 1568 svchost.exe Token: SeAssignPrimaryTokenPrivilege 1568 svchost.exe Token: SeImpersonatePrivilege 1568 svchost.exe Token: SeTcbPrivilege 1568 svchost.exe Token: SeChangeNotifyPrivilege 1568 svchost.exe Token: SeCreateTokenPrivilege 1568 svchost.exe Token: SeBackupPrivilege 1568 svchost.exe Token: SeRestorePrivilege 1568 svchost.exe Token: SeIncreaseQuotaPrivilege 1568 svchost.exe Token: SeAssignPrimaryTokenPrivilege 1568 svchost.exe Token: SeImpersonatePrivilege 2356 svchost.exe Token: SeTcbPrivilege 2356 svchost.exe Token: SeChangeNotifyPrivilege 2356 svchost.exe Token: SeCreateTokenPrivilege 2356 svchost.exe Token: SeBackupPrivilege 2356 svchost.exe Token: SeRestorePrivilege 2356 svchost.exe Token: SeIncreaseQuotaPrivilege 2356 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2356 svchost.exe Token: SeImpersonatePrivilege 2356 svchost.exe Token: SeTcbPrivilege 2356 svchost.exe Token: SeChangeNotifyPrivilege 2356 svchost.exe Token: SeCreateTokenPrivilege 2356 svchost.exe Token: SeBackupPrivilege 2356 svchost.exe Token: SeRestorePrivilege 2356 svchost.exe Token: SeIncreaseQuotaPrivilege 2356 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2356 svchost.exe Token: SeImpersonatePrivilege 2356 svchost.exe Token: SeTcbPrivilege 2356 svchost.exe Token: SeChangeNotifyPrivilege 2356 svchost.exe Token: SeCreateTokenPrivilege 2356 svchost.exe Token: SeBackupPrivilege 2356 svchost.exe Token: SeRestorePrivilege 2356 svchost.exe Token: SeIncreaseQuotaPrivilege 2356 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2356 svchost.exe Token: SeRestorePrivilege 4076 WerFault.exe Token: SeBackupPrivilege 4076 WerFault.exe Token: SeDebugPrivilege 4076 WerFault.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2984 EXCEL.EXE - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2984 EXCEL.EXE 2984 EXCEL.EXE - Loads dropped DLL 1 IoCs
pid Process 852 regsvr32.exe - Program crash 1 IoCs
pid pid_target Process procid_target 4076 852 WerFault.exe 74 - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2984 wrote to memory of 632 2984 EXCEL.EXE 73 PID 2984 wrote to memory of 632 2984 EXCEL.EXE 73 PID 632 wrote to memory of 852 632 regsvr32.exe 74 PID 632 wrote to memory of 852 632 regsvr32.exe 74 PID 632 wrote to memory of 852 632 regsvr32.exe 74 PID 852 wrote to memory of 1568 852 regsvr32.exe 76 PID 852 wrote to memory of 1568 852 regsvr32.exe 76 PID 852 wrote to memory of 1568 852 regsvr32.exe 76 PID 852 wrote to memory of 1568 852 regsvr32.exe 76 PID 852 wrote to memory of 1568 852 regsvr32.exe 76 PID 1568 wrote to memory of 948 1568 svchost.exe 77 PID 1568 wrote to memory of 948 1568 svchost.exe 77 PID 1568 wrote to memory of 948 1568 svchost.exe 77 PID 1568 wrote to memory of 2356 1568 svchost.exe 79 PID 1568 wrote to memory of 2356 1568 svchost.exe 79 PID 1568 wrote to memory of 2356 1568 svchost.exe 79 PID 1568 wrote to memory of 2356 1568 svchost.exe 79 PID 1568 wrote to memory of 2356 1568 svchost.exe 79 - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 852 set thread context of 1568 852 regsvr32.exe 76 PID 1568 set thread context of 2356 1568 svchost.exe 79 - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 21 api.ipify.org - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE - Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.DOC.Kryptik.Q.14432.xls"1⤵
- Suspicious use of SetWindowsHookEx
- Checks processor information in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
- Enumerates system info in registry
PID:2984 -
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s /i BvkFvmz.ocx2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Windows\SysWOW64\regsvr32.exe/s /i BvkFvmz.ocx3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:852 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\System32\svchost.exe4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1568 -
C:\Windows\SysWOW64\cmd.execmd /K5⤵PID:948
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\System32\svchost.exe5⤵
- Suspicious use of AdjustPrivilegeToken
PID:2356
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 852 -s 6684⤵
- Suspicious behavior: EnumeratesProcesses
- Program crash
PID:4076
-
-
-