Analysis
-
max time kernel
70s -
max time network
42s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
14-01-2021 16:18
Behavioral task
behavioral1
Sample
d85b3c0bee9a537ec923c070fde22f9e275130ab2c3e031397796cc856a44588.xlsm
Resource
win7v20201028
Behavioral task
behavioral2
Sample
d85b3c0bee9a537ec923c070fde22f9e275130ab2c3e031397796cc856a44588.xlsm
Resource
win10v20201028
General
-
Target
d85b3c0bee9a537ec923c070fde22f9e275130ab2c3e031397796cc856a44588.xlsm
-
Size
25KB
-
MD5
c22078f129f1d702314102bc47fa5a77
-
SHA1
b9fb91344d5276c9ca779867fecea5ac80c89f21
-
SHA256
d85b3c0bee9a537ec923c070fde22f9e275130ab2c3e031397796cc856a44588
-
SHA512
aad36bb3ce63f59fae9b4d66ec5a6921edba8903c684746021a44c04817635513cedf48fb34bd69c14637874313de66a7e5d623dd36011bffae1728e7398cd9e
Malware Config
Extracted
http://nicknewsteadconstructions.com.au/zhsvrgfcs/55555555555.jpg
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rundll32.exedescription pid pid_target process target process Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 304 1888 rundll32.exe EXCEL.EXE -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
EXCEL.EXEdescription ioc process File opened (read-only) \??\B: EXCEL.EXE File opened (read-only) \??\N: EXCEL.EXE File opened (read-only) \??\O: EXCEL.EXE File opened (read-only) \??\R: EXCEL.EXE File opened (read-only) \??\S: EXCEL.EXE File opened (read-only) \??\U: EXCEL.EXE File opened (read-only) \??\F: EXCEL.EXE File opened (read-only) \??\G: EXCEL.EXE File opened (read-only) \??\L: EXCEL.EXE File opened (read-only) \??\Z: EXCEL.EXE File opened (read-only) \??\J: EXCEL.EXE File opened (read-only) \??\K: EXCEL.EXE File opened (read-only) \??\P: EXCEL.EXE File opened (read-only) \??\T: EXCEL.EXE File opened (read-only) \??\V: EXCEL.EXE File opened (read-only) \??\W: EXCEL.EXE File opened (read-only) \??\X: EXCEL.EXE File opened (read-only) \??\Y: EXCEL.EXE File opened (read-only) \??\A: EXCEL.EXE File opened (read-only) \??\E: EXCEL.EXE File opened (read-only) \??\H: EXCEL.EXE File opened (read-only) \??\I: EXCEL.EXE File opened (read-only) \??\M: EXCEL.EXE File opened (read-only) \??\Q: EXCEL.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Processes:
EXCEL.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1888 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
EXCEL.EXEpid process 1888 EXCEL.EXE 1888 EXCEL.EXE 1888 EXCEL.EXE 1888 EXCEL.EXE 1888 EXCEL.EXE 1888 EXCEL.EXE 1888 EXCEL.EXE -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
EXCEL.EXEdescription pid process target process PID 1888 wrote to memory of 304 1888 EXCEL.EXE rundll32.exe PID 1888 wrote to memory of 304 1888 EXCEL.EXE rundll32.exe PID 1888 wrote to memory of 304 1888 EXCEL.EXE rundll32.exe PID 1888 wrote to memory of 304 1888 EXCEL.EXE rundll32.exe PID 1888 wrote to memory of 304 1888 EXCEL.EXE rundll32.exe PID 1888 wrote to memory of 304 1888 EXCEL.EXE rundll32.exe PID 1888 wrote to memory of 304 1888 EXCEL.EXE rundll32.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\d85b3c0bee9a537ec923c070fde22f9e275130ab2c3e031397796cc856a44588.xlsm1⤵
- Enumerates connected drives
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe ..\AppData\Roaming\Gertik.JJSSDDFF,DllRegisterServer2⤵
- Process spawned unexpected child process
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Gertik.JJSSDDFFMD5
0357aa49ea850b11b99d09a2479c321b
SHA141472ba5c40f61fa1c77c42cf06248f13b8785f0
SHA2560ff0b7fcb090c65d0bdcb2af4bbd2c30f33356b3ce9b117186fa20391ef840a3
SHA512a317a0f035b8dff7ca60c76b0b75698a3528fd4c7c5e915292c982d2b38c1c937c318362c891e93bee6fdb1b166764d7183140a837fd23daa2be3d2dac5a5dfc
-
memory/304-3-0x0000000000000000-mapping.dmp
-
memory/2032-2-0x000007FEF5F60000-0x000007FEF61DA000-memory.dmpFilesize
2.5MB