64f8921376f7e680cf53e889b99b418b6970a491b32305ce994ef919aef64445

General

Target

CompensationClaim-1190633265-11242020.xls
Size

61KB
MD5

b66c611239f82ee9b04051591ddedcc9
SHA1

57d36b574cd37f069ffa513f533e31e7a12aa79b
SHA256

64f8921376f7e680cf53e889b99b418b6970a491b32305ce994ef919aef64445
SHA512

756cb685765abc96444d6b8f0b1891c25ba54690337066ac8d7bcd65c404ae4cf9b1bef8edc525c2da9674c8893b8a59f34faa8b7900e190541fc757b6e3dd9e

Score

10^/10

cryptone packer

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

regsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	2064	1020	regsvr32.exe	EXCEL.EXE

CryptOne packer 2 IoCs

Detects CryptOne packer defined in NCC blogpost.

cryptone packer

Processes:

resource	yara_rule
C:\LotWin\LotWin2\Horsew.dll	cryptone
\LotWin\LotWin2\Horsew.dll	cryptone

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1392 regsvr32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3240 1392 WerFault.exe regsvr32.exe

pid	pid_target	process	target process
3240	1392	WerFault.exe	regsvr32.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

regsvr32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	regsvr32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1020 EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 19 IoCs

Processes:

regsvr32.exeWerFault.exe

pid	process
1392	regsvr32.exe
1392	regsvr32.exe
1392	regsvr32.exe
1392	regsvr32.exe
3240	WerFault.exe
3240	WerFault.exe
3240	WerFault.exe
3240	WerFault.exe
3240	WerFault.exe
3240	WerFault.exe
3240	WerFault.exe
3240	WerFault.exe
3240	WerFault.exe
3240	WerFault.exe
3240	WerFault.exe
3240	WerFault.exe
3240	WerFault.exe
3240	WerFault.exe
3240	WerFault.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

regsvr32.exe

pid process

1392 regsvr32.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3240 WerFault.exe
Token: SeBackupPrivilege 3240 WerFault.exe
Token: SeDebugPrivilege 3240 WerFault.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

EXCEL.EXE

pid process

1020 EXCEL.EXE
1020 EXCEL.EXE

description	pid	process
Token: SeRestorePrivilege	3240	WerFault.exe
Token: SeBackupPrivilege	3240	WerFault.exe
Token: SeDebugPrivilege	3240	WerFault.exe

Suspicious use of SetWindowsHookEx 14 IoCs

Processes:

EXCEL.EXE

pid	process
1020	EXCEL.EXE
1020	EXCEL.EXE
1020	EXCEL.EXE
1020	EXCEL.EXE
1020	EXCEL.EXE
1020	EXCEL.EXE
1020	EXCEL.EXE
1020	EXCEL.EXE
1020	EXCEL.EXE
1020	EXCEL.EXE
1020	EXCEL.EXE
1020	EXCEL.EXE
1020	EXCEL.EXE
1020	EXCEL.EXE

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

EXCEL.EXEregsvr32.exeregsvr32.exe

description	pid	process	target process
PID 1020 wrote to memory of 2064	1020	EXCEL.EXE	regsvr32.exe
PID 1020 wrote to memory of 2064	1020	EXCEL.EXE	regsvr32.exe
PID 2064 wrote to memory of 1392	2064	regsvr32.exe	regsvr32.exe
PID 2064 wrote to memory of 1392	2064	regsvr32.exe	regsvr32.exe
PID 2064 wrote to memory of 1392	2064	regsvr32.exe	regsvr32.exe
PID 1392 wrote to memory of 2836	1392	regsvr32.exe	explorer.exe
PID 1392 wrote to memory of 2836	1392	regsvr32.exe	explorer.exe
PID 1392 wrote to memory of 2836	1392	regsvr32.exe	explorer.exe
PID 1392 wrote to memory of 2836	1392	regsvr32.exe	explorer.exe
PID 1392 wrote to memory of 2836	1392	regsvr32.exe	explorer.exe

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\CompensationClaim-1190633265-11242020.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1020

C:\Windows\SYSTEM32\regsvr32.exe
regsvr32.exe -s C:\LotWin\LotWin2\Horsew.dll
2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2064

C:\Windows\SysWOW64\regsvr32.exe
-s C:\LotWin\LotWin2\Horsew.dll
3⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1392

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
PID:2836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 744
4⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3240

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

3

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\LotWin\LotWin2\Horsew.dll
MD5
e82c47f72c45ef40639b2d425c44c8b4

SHA1
d8c95d91327757ecd5c73fc32f951510c27f9c92

SHA256
d62eba38865a40e9331bbff8ca0b171344dd6a2a80cf5404c65b0b13c52f6e57

SHA512
0d9d742451f01e29b8298f5b2167fe2e2439333998f16fb6d672a23fd66543e885a29734e6abd7f9b87910ad5064d1e1b318d9915b3ce9f1d75c9b0f371bdcd5

Download Submit
\LotWin\LotWin2\Horsew.dll
MD5
e82c47f72c45ef40639b2d425c44c8b4

SHA1
d8c95d91327757ecd5c73fc32f951510c27f9c92

SHA256
d62eba38865a40e9331bbff8ca0b171344dd6a2a80cf5404c65b0b13c52f6e57

SHA512
0d9d742451f01e29b8298f5b2167fe2e2439333998f16fb6d672a23fd66543e885a29734e6abd7f9b87910ad5064d1e1b318d9915b3ce9f1d75c9b0f371bdcd5

Download Submit
memory/1020-0-0x00007FFF2CC70000-0x00007FFF2D2A7000-memory.dmp

Filesize
6.2MB

Download
memory/1392-3-0x0000000000000000-mapping.dmp

Download
memory/1392-5-0x0000000002700000-0x0000000002720000-memory.dmp

Filesize
128KB

Download
memory/1392-7-0x00000000026D0000-0x00000000026F0000-memory.dmp

Filesize
128KB

Download
memory/1392-12-0x0000000000000000-mapping.dmp

Download
memory/1392-11-0x0000000000000000-mapping.dmp

Download
memory/2064-1-0x0000000000000000-mapping.dmp

Download
memory/2836-6-0x0000000000000000-mapping.dmp

Download
memory/3240-10-0x0000000004AA0000-0x0000000004AA1000-memory.dmp

Filesize
4KB

Download
memory/3240-13-0x0000000005320000-0x0000000005321000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads