f726cbe23062b21e3eee285a2fb0d3b8d86bcf918b2b52c32f4949a86f66514e

General

Target

11182140512.xls
Size

103KB
MD5

fcca012018f8aa9fbfeb705664a5db2b
SHA1

71123bd3c44bc29a49f4e65d14bc5e52c52927c2
SHA256

f726cbe23062b21e3eee285a2fb0d3b8d86bcf918b2b52c32f4949a86f66514e
SHA512

09fb53f13b8a35ff107d6f0781db9efceb60b597d520544a88159cdaaa43cd7afbac6230d8ab0d25164b4441e57fae9b55c13cd0be08d83482d319886ec1b5f1

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 4 IoCs

Processes:

Zerio.exeZerio.exewqrybuo.exewqrybuo.exe

pid process

2304 Zerio.exe
2596 Zerio.exe
3128 wqrybuo.exe
1264 wqrybuo.exe

pid	process
2304	Zerio.exe
2596	Zerio.exe
3128	wqrybuo.exe
1264	wqrybuo.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

Zerio.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	Zerio.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	Zerio.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	Zerio.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	Zerio.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	Zerio.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	Zerio.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2752 schtasks.exe

pid	process
2752	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

3952 EXCEL.EXE
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

Zerio.exeZerio.exewqrybuo.exe

pid process

2304 Zerio.exe
2304 Zerio.exe
2596 Zerio.exe
2596 Zerio.exe
2596 Zerio.exe
2596 Zerio.exe
3128 wqrybuo.exe
3128 wqrybuo.exe

pid	process
2304	Zerio.exe
2304	Zerio.exe
2596	Zerio.exe
2596	Zerio.exe
2596	Zerio.exe
2596	Zerio.exe
3128	wqrybuo.exe
3128	wqrybuo.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

EXCEL.EXE

pid	process
3952	EXCEL.EXE
3952	EXCEL.EXE
3952	EXCEL.EXE
3952	EXCEL.EXE
3952	EXCEL.EXE
3952	EXCEL.EXE
3952	EXCEL.EXE
3952	EXCEL.EXE
3952	EXCEL.EXE
3952	EXCEL.EXE
3952	EXCEL.EXE
3952	EXCEL.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

EXCEL.EXEZerio.exewqrybuo.exe

description	pid	process	target process
PID 3952 wrote to memory of 2304	3952	EXCEL.EXE	Zerio.exe
PID 3952 wrote to memory of 2304	3952	EXCEL.EXE	Zerio.exe
PID 3952 wrote to memory of 2304	3952	EXCEL.EXE	Zerio.exe
PID 2304 wrote to memory of 2596	2304	Zerio.exe	Zerio.exe
PID 2304 wrote to memory of 2596	2304	Zerio.exe	Zerio.exe
PID 2304 wrote to memory of 2596	2304	Zerio.exe	Zerio.exe
PID 2304 wrote to memory of 3128	2304	Zerio.exe	wqrybuo.exe
PID 2304 wrote to memory of 3128	2304	Zerio.exe	wqrybuo.exe
PID 2304 wrote to memory of 3128	2304	Zerio.exe	wqrybuo.exe
PID 2304 wrote to memory of 2752	2304	Zerio.exe	schtasks.exe
PID 2304 wrote to memory of 2752	2304	Zerio.exe	schtasks.exe
PID 2304 wrote to memory of 2752	2304	Zerio.exe	schtasks.exe
PID 3128 wrote to memory of 1264	3128	wqrybuo.exe	wqrybuo.exe
PID 3128 wrote to memory of 1264	3128	wqrybuo.exe	wqrybuo.exe
PID 3128 wrote to memory of 1264	3128	wqrybuo.exe	wqrybuo.exe

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\11182140512.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3952
- C:\Droft\Frots\Zerio.exe
  "C:\Droft\Frots\Zerio.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2304
- - C:\Droft\Frots\Zerio.exe
    C:\Droft\Frots\Zerio.exe /C
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    - Suspicious behavior: EnumeratesProcesses
    PID:2596
- - C:\Users\Admin\AppData\Roaming\Microsoft\Xabaaqdduf\wqrybuo.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Xabaaqdduf\wqrybuo.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3128
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Xabaaqdduf\wqrybuo.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Xabaaqdduf\wqrybuo.exe /C
      4⤵
      Executes dropped EXE
      PID:1264
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn limhvdbeua /tr "\"C:\Droft\Frots\Zerio.exe\" /I limhvdbeua" /SC ONCE /Z /ST 09:33 /ET 09:45
    3⤵
    - Creates scheduled task(s)
    PID:2752

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Droft\Frots\Zerio.exe

Download Submit
C:\Droft\Frots\Zerio.exe

Download Submit
C:\Droft\Frots\Zerio.exe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Xabaaqdduf\wqrybuo.exe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Xabaaqdduf\wqrybuo.exe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Xabaaqdduf\wqrybuo.exe

Download Submit
memory/1264-11-0x0000000000000000-mapping.dmp

Download
memory/2304-1-0x0000000000000000-mapping.dmp

Download
memory/2596-6-0x0000000002B90000-0x0000000002B91000-memory.dmp

Filesize
4KB

Download
memory/2596-4-0x0000000000000000-mapping.dmp

Download
memory/2752-10-0x0000000000000000-mapping.dmp

Download
memory/3128-7-0x0000000000000000-mapping.dmp

Download
memory/3952-0-0x00007FF8C2FC0000-0x00007FF8C3686000-memory.dmp

Filesize
6.8MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads