Analysis
- max time kernel
90s - max time network
91s - platform
windows7_x64 - resource
win7v20201028 - submitted
17/12/2020, 18:27
Static task
static1
Behavioral task
behavioral1
Sample
faktura_18.xlsm
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target faktura_18.xlsm
- Size 95KB
- Sample201217-bavzn97yh2
- SHA256 3ad4819cec95571fba65855ebde66a308472c22a4c06501bfa1b1d51730572cc
- MD5 69f269d0a5e726c0bcafa1e81a456f79
- SHA1 a6537a821e059c4d10f9c35f0135e3af0227c9e9
- SHA512 72a229fa07b9d71cca6b120f7f2cf57b23c535d4bafe4b5bb65e9e0202e822ebfd7a54405e8b60c0514728f3c7815513049a049e1bde7ed02637e3c5e44dd1c9
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Language
-
xlm4.0
Source
URLs
-
xlm40.dropper
https://oidblueprin.at/3/str.dll
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1628 1072 rundll32.exe 24 - Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: EXCEL.EXE File opened (read-only) \??\P: EXCEL.EXE File opened (read-only) \??\U: EXCEL.EXE File opened (read-only) \??\B: EXCEL.EXE File opened (read-only) \??\F: EXCEL.EXE File opened (read-only) \??\L: EXCEL.EXE File opened (read-only) \??\N: EXCEL.EXE File opened (read-only) \??\R: EXCEL.EXE File opened (read-only) \??\S: EXCEL.EXE File opened (read-only) \??\V: EXCEL.EXE File opened (read-only) \??\Y: EXCEL.EXE File opened (read-only) \??\A: EXCEL.EXE File opened (read-only) \??\H: EXCEL.EXE File opened (read-only) \??\J: EXCEL.EXE File opened (read-only) \??\K: EXCEL.EXE File opened (read-only) \??\O: EXCEL.EXE File opened (read-only) \??\T: EXCEL.EXE File opened (read-only) \??\Z: EXCEL.EXE File opened (read-only) \??\E: EXCEL.EXE File opened (read-only) \??\G: EXCEL.EXE File opened (read-only) \??\W: EXCEL.EXE File opened (read-only) \??\X: EXCEL.EXE File opened (read-only) \??\I: EXCEL.EXE File opened (read-only) \??\Q: EXCEL.EXE - Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1072 EXCEL.EXE - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1072 EXCEL.EXE 1072 EXCEL.EXE 1072 EXCEL.EXE - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1072 wrote to memory of 1628 1072 EXCEL.EXE 31 PID 1072 wrote to memory of 1628 1072 EXCEL.EXE 31 PID 1072 wrote to memory of 1628 1072 EXCEL.EXE 31 PID 1072 wrote to memory of 1628 1072 EXCEL.EXE 31 PID 1072 wrote to memory of 1628 1072 EXCEL.EXE 31 PID 1072 wrote to memory of 1628 1072 EXCEL.EXE 31 PID 1072 wrote to memory of 1628 1072 EXCEL.EXE 31
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\faktura_18.xlsm1⤵
- Enumerates connected drives
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\HFKhnuZ\mlCGIzZ\uOUcRwG.dll,DllRegisterServer2⤵
- Process spawned unexpected child process
PID:1628
-