Analysis
-
max time kernel
136s -
max time network
135s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
15/07/2020, 22:54
Static task
static1
Behavioral task
behavioral1
Sample
in_1.xls
Resource
win7
windows7_x64
0 signatures
0 seconds
General
-
Target
in_1.xls
-
Size
90KB
-
MD5
9c3690174951e5671dfecd0cea0b0e8f
-
SHA1
e2b895c22b0f40bf45b6b97256d193f119660ebd
-
SHA256
23ade68c3bd6e2a1be4b9cf48e5e9d08a1dd06219595087dc9607d1e20db8f40
-
SHA512
29bf563effc5d3786162e1922168e3947fe9f590c7664dea0180a98cd62a6380d2c0506b2426f7233d4c830aef853db76764ec41a2602dc63a46918c547de6f2
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 3184 wrote to memory of 3316 3184 EXCEL.EXE 75 PID 3184 wrote to memory of 3316 3184 EXCEL.EXE 75 PID 3316 wrote to memory of 696 3316 regsvr32.exe 76 PID 3316 wrote to memory of 696 3316 regsvr32.exe 76 PID 3316 wrote to memory of 696 3316 regsvr32.exe 76 PID 696 wrote to memory of 1596 696 regsvr32.exe 78 PID 696 wrote to memory of 1596 696 regsvr32.exe 78 PID 696 wrote to memory of 1596 696 regsvr32.exe 78 PID 696 wrote to memory of 1596 696 regsvr32.exe 78 PID 696 wrote to memory of 1596 696 regsvr32.exe 78 PID 1596 wrote to memory of 3808 1596 svchost.exe 79 PID 1596 wrote to memory of 3808 1596 svchost.exe 79 PID 1596 wrote to memory of 3808 1596 svchost.exe 79 PID 1596 wrote to memory of 992 1596 svchost.exe 81 PID 1596 wrote to memory of 992 1596 svchost.exe 81 PID 1596 wrote to memory of 992 1596 svchost.exe 81 PID 1596 wrote to memory of 992 1596 svchost.exe 81 PID 1596 wrote to memory of 992 1596 svchost.exe 81 -
Suspicious behavior: EnumeratesProcesses 19 IoCs
pid Process 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 3880 WerFault.exe 3880 WerFault.exe 3880 WerFault.exe 3880 WerFault.exe 3880 WerFault.exe 3880 WerFault.exe 3880 WerFault.exe 3880 WerFault.exe 3880 WerFault.exe 3880 WerFault.exe 3880 WerFault.exe 3880 WerFault.exe 3880 WerFault.exe 3880 WerFault.exe 3880 WerFault.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE -
Loads dropped DLL 1 IoCs
pid Process 696 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 25 api.ipify.org -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 3184 EXCEL.EXE 3184 EXCEL.EXE 3184 EXCEL.EXE 3184 EXCEL.EXE 3184 EXCEL.EXE 3184 EXCEL.EXE 3184 EXCEL.EXE 3184 EXCEL.EXE 3184 EXCEL.EXE 3184 EXCEL.EXE 3184 EXCEL.EXE 3184 EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3184 EXCEL.EXE -
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3316 3184 regsvr32.exe 65 -
Program crash 1 IoCs
pid pid_target Process procid_target 3880 696 WerFault.exe 76 -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 696 set thread context of 1596 696 regsvr32.exe 78 PID 1596 set thread context of 992 1596 svchost.exe 81 -
Suspicious use of AdjustPrivilegeToken 67 IoCs
description pid Process Token: SeImpersonatePrivilege 1596 svchost.exe Token: SeTcbPrivilege 1596 svchost.exe Token: SeChangeNotifyPrivilege 1596 svchost.exe Token: SeCreateTokenPrivilege 1596 svchost.exe Token: SeBackupPrivilege 1596 svchost.exe Token: SeRestorePrivilege 1596 svchost.exe Token: SeIncreaseQuotaPrivilege 1596 svchost.exe Token: SeAssignPrimaryTokenPrivilege 1596 svchost.exe Token: SeImpersonatePrivilege 1596 svchost.exe Token: SeTcbPrivilege 1596 svchost.exe Token: SeChangeNotifyPrivilege 1596 svchost.exe Token: SeCreateTokenPrivilege 1596 svchost.exe Token: SeBackupPrivilege 1596 svchost.exe Token: SeRestorePrivilege 1596 svchost.exe Token: SeIncreaseQuotaPrivilege 1596 svchost.exe Token: SeAssignPrimaryTokenPrivilege 1596 svchost.exe Token: SeImpersonatePrivilege 1596 svchost.exe Token: SeTcbPrivilege 1596 svchost.exe Token: SeChangeNotifyPrivilege 1596 svchost.exe Token: SeCreateTokenPrivilege 1596 svchost.exe Token: SeBackupPrivilege 1596 svchost.exe Token: SeRestorePrivilege 1596 svchost.exe Token: SeIncreaseQuotaPrivilege 1596 svchost.exe Token: SeAssignPrimaryTokenPrivilege 1596 svchost.exe Token: SeImpersonatePrivilege 1596 svchost.exe Token: SeTcbPrivilege 1596 svchost.exe Token: SeChangeNotifyPrivilege 1596 svchost.exe Token: SeCreateTokenPrivilege 1596 svchost.exe Token: SeBackupPrivilege 1596 svchost.exe Token: SeRestorePrivilege 1596 svchost.exe Token: SeIncreaseQuotaPrivilege 1596 svchost.exe Token: SeAssignPrimaryTokenPrivilege 1596 svchost.exe Token: SeImpersonatePrivilege 1596 svchost.exe Token: SeTcbPrivilege 1596 svchost.exe Token: SeChangeNotifyPrivilege 1596 svchost.exe Token: SeCreateTokenPrivilege 1596 svchost.exe Token: SeBackupPrivilege 1596 svchost.exe Token: SeRestorePrivilege 1596 svchost.exe Token: SeIncreaseQuotaPrivilege 1596 svchost.exe Token: SeAssignPrimaryTokenPrivilege 1596 svchost.exe Token: SeImpersonatePrivilege 992 svchost.exe Token: SeTcbPrivilege 992 svchost.exe Token: SeChangeNotifyPrivilege 992 svchost.exe Token: SeCreateTokenPrivilege 992 svchost.exe Token: SeBackupPrivilege 992 svchost.exe Token: SeRestorePrivilege 992 svchost.exe Token: SeIncreaseQuotaPrivilege 992 svchost.exe Token: SeAssignPrimaryTokenPrivilege 992 svchost.exe Token: SeImpersonatePrivilege 992 svchost.exe Token: SeTcbPrivilege 992 svchost.exe Token: SeChangeNotifyPrivilege 992 svchost.exe Token: SeCreateTokenPrivilege 992 svchost.exe Token: SeBackupPrivilege 992 svchost.exe Token: SeRestorePrivilege 992 svchost.exe Token: SeIncreaseQuotaPrivilege 992 svchost.exe Token: SeAssignPrimaryTokenPrivilege 992 svchost.exe Token: SeImpersonatePrivilege 992 svchost.exe Token: SeTcbPrivilege 992 svchost.exe Token: SeChangeNotifyPrivilege 992 svchost.exe Token: SeCreateTokenPrivilege 992 svchost.exe Token: SeBackupPrivilege 992 svchost.exe Token: SeRestorePrivilege 992 svchost.exe Token: SeIncreaseQuotaPrivilege 992 svchost.exe Token: SeAssignPrimaryTokenPrivilege 992 svchost.exe Token: SeRestorePrivilege 3880 WerFault.exe Token: SeBackupPrivilege 3880 WerFault.exe Token: SeDebugPrivilege 3880 WerFault.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\in_1.xls"1⤵
- Suspicious use of WriteProcessMemory
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
- Enumerates system info in registry
PID:3184 -
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s /i BvkFvmz.ocx2⤵
- Suspicious use of WriteProcessMemory
- Process spawned unexpected child process
PID:3316 -
C:\Windows\SysWOW64\regsvr32.exe/s /i BvkFvmz.ocx3⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:696 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\System32\svchost.exe4⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1596 -
C:\Windows\SysWOW64\cmd.execmd /K5⤵PID:3808
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\System32\svchost.exe5⤵
- Suspicious use of AdjustPrivilegeToken
PID:992
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 696 -s 6644⤵
- Suspicious behavior: EnumeratesProcesses
- Program crash
PID:3880
-
-
-