425a292d93fc938bbf2f3f2b835f5408bf92c7851bfcbbe3746886edb6cceb4b

General

Target
PO_10044885_Mahler-Besse_2_21_2020.xlsm
Size 78KB
Sample200730-kh3djqlca6
SHA256 425a292d93fc938bbf2f3f2b835f5408bf92c7851bfcbbe3746886edb6cceb4b
MD5 90f10269f8ec5f44eeed517544711539
SHA1 385f17a986f4a2bb632ed9b6e6e3cd2edf1007c5
SHA512 dff4b9ea38c6a96fadf2806232619829701e73d7348cdf20ae17161e2f0eed0999168bbba02b0bfc2626387a8904844154e5c680a731d7002c9a8310a590b767
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1448	EXCEL.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1868	svchost32.exe
Token: SeDebugPrivilege	612	WerFault.exe
Token: SeDebugPrivilege	1956	AddInProcess32.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1868	svchost32.exe
1868	svchost32.exe
1868	svchost32.exe
612	WerFault.exe
612	WerFault.exe
612	WerFault.exe
612	WerFault.exe
612	WerFault.exe
1956	AddInProcess32.exe
1956	AddInProcess32.exe

Loads dropped DLL 6 IoCs

pid	Process
1868	svchost32.exe
612	WerFault.exe
612	WerFault.exe
612	WerFault.exe
612	WerFault.exe
612	WerFault.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1868 set thread context of 1956	1868	svchost32.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
612	1868	WerFault.exe	26

Office loads VBA resources, possible macro or embedded object present

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1448	EXCEL.EXE
1448	EXCEL.EXE
1448	EXCEL.EXE
1448	EXCEL.EXE
1448	EXCEL.EXE

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 1868	1448	EXCEL.EXE	26
PID 1448 wrote to memory of 1868	1448	EXCEL.EXE	26
PID 1448 wrote to memory of 1868	1448	EXCEL.EXE	26
PID 1448 wrote to memory of 1868	1448	EXCEL.EXE	26
PID 1868 wrote to memory of 1956	1868	svchost32.exe	28
PID 1868 wrote to memory of 1956	1868	svchost32.exe	28
PID 1868 wrote to memory of 1956	1868	svchost32.exe	28
PID 1868 wrote to memory of 1956	1868	svchost32.exe	28
PID 1868 wrote to memory of 1956	1868	svchost32.exe	28
PID 1868 wrote to memory of 1956	1868	svchost32.exe	28
PID 1868 wrote to memory of 1956	1868	svchost32.exe	28
PID 1868 wrote to memory of 1956	1868	svchost32.exe	28
PID 1868 wrote to memory of 1956	1868	svchost32.exe	28
PID 1868 wrote to memory of 612	1868	svchost32.exe	31
PID 1868 wrote to memory of 612	1868	svchost32.exe	31
PID 1868 wrote to memory of 612	1868	svchost32.exe	31
PID 1868 wrote to memory of 612	1868	svchost32.exe	31

Executes dropped EXE 2 IoCs

pid	Process
1868	svchost32.exe
1956	AddInProcess32.exe

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\PO_10044885_Mahler-Besse_2_21_2020.xlsm
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Users\Public\svchost32.exe
  "C:\Users\Public\svchost32.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  - Executes dropped EXE
  PID:1868
- - C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe
    "C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious behavior: EnumeratesProcesses
    - Executes dropped EXE
    PID:1956
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 780
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious behavior: EnumeratesProcesses
    - Loads dropped DLL
    - Program crash
    PID:612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/612-22-0x00000000021C0000-0x00000000021D1000-memory.dmp

Download

memory/612-38-0x00000000027F0000-0x0000000002801000-memory.dmp

Download

memory/1448-7-0x0000000006869000-0x000000000686D000-memory.dmp

Download

memory/1448-2-0x00000000024E0000-0x00000000024E1000-memory.dmp

Download

memory/1448-3-0x00000000004F5000-0x00000000004F6000-memory.dmp

Download

memory/1448-0-0x00000000024E0000-0x00000000024E1000-memory.dmp

Download

memory/1956-15-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/1956-19-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/1956-18-0x0000000000400000-0x000000000044C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads