eda68de6706516012cda72a22a1e9e089d85ad324f47768bb982eea97836fd8d

General

Target
BLTAX.xlsm.exe
Size 421KB
Sample200825-9ve5d74lja
SHA256 eda68de6706516012cda72a22a1e9e089d85ad324f47768bb982eea97836fd8d
MD5 99ccdd9c78e8ef14dc061f2de2ec3f22
SHA1 d2f523974efc348e14b2460f685af5e8227d056f
SHA512 c1fdde88865b2a367662d18b1c5a8e1d9cb1f0f5b42f3025bd63b4da0287c7a9ea5a914bdc131329e561ed28b59a42ff308d429f2feec6ab4628437a0e1d8471
MD5 SHA1 SHA512

Score

9^/10

evasion

Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	BLTAX.xlsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	BLTAX.xlsm.exe

Loads dropped DLL 1 IoCs

pid	Process
2240	BLTAX.xlsm.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	BLTAX.xlsm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	BLTAX.xlsm.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3060 set thread context of 2240	3060	BLTAX.xlsm.exe	75

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
3208	schtasks.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 3208	3060	BLTAX.xlsm.exe	73
PID 3060 wrote to memory of 3208	3060	BLTAX.xlsm.exe	73
PID 3060 wrote to memory of 3208	3060	BLTAX.xlsm.exe	73
PID 3060 wrote to memory of 2240	3060	BLTAX.xlsm.exe	75
PID 3060 wrote to memory of 2240	3060	BLTAX.xlsm.exe	75
PID 3060 wrote to memory of 2240	3060	BLTAX.xlsm.exe	75
PID 3060 wrote to memory of 2240	3060	BLTAX.xlsm.exe	75
PID 3060 wrote to memory of 2240	3060	BLTAX.xlsm.exe	75
PID 3060 wrote to memory of 2240	3060	BLTAX.xlsm.exe	75

C:\Users\Admin\AppData\Local\Temp\BLTAX.xlsm.exe
"C:\Users\Admin\AppData\Local\Temp\BLTAX.xlsm.exe"
1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xFFgPbPjc" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3619.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:3208
- C:\Users\Admin\AppData\Local\Temp\BLTAX.xlsm.exe
  "C:\Users\Admin\AppData\Local\Temp\BLTAX.xlsm.exe"
  2⤵
  - Loads dropped DLL
  PID:2240