Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
05-03-2021 17:25
Behavioral task
behavioral1
Sample
Debt-Details-1318148499-03052021.xls
Resource
win7v20201028
Behavioral task
behavioral2
Sample
Debt-Details-1318148499-03052021.xls
Resource
win10v20201028
General
-
Target
Debt-Details-1318148499-03052021.xls
-
Size
78KB
-
MD5
e71d78a14a5f0a046e12ab09ff674533
-
SHA1
e59eef89178ff2824777b7f5ca44e50950fff88e
-
SHA256
903d82f687b952277d18912b1492339944d8632c139329ba5a32c4b6b47362bf
-
SHA512
2b66cfad8c841373868ca9274c1ce8ed1f9a9666aacc8ae37256a628c9851e4b1a02579716b81f3408b8c5dfbf2e6d82ba4e7e219896dca41d5cfb1a39a969d5
Malware Config
Extracted
http://kosherbansko.com/vozrhzftc/44260.7283011574.dat
http://beautyhair.by/rkqhopvrb/44260.7283011574.dat
http://trysaileggplants.com/xbbomazcknz/44260.7283011574.dat
http://giftcard16.com/pghxph/44260.7283011574.dat
http://www.ausfencing.org/jqikucbefrth/44260.7283011574.dat
Signatures
-
Process spawned unexpected child process 5 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rundll32.exerundll32.exerundll32.exerundll32.exerundll32.exedescription pid pid_target process target process Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 524 776 rundll32.exe EXCEL.EXE Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1648 776 rundll32.exe EXCEL.EXE Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 924 776 rundll32.exe EXCEL.EXE Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 836 776 rundll32.exe EXCEL.EXE Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 664 776 rundll32.exe EXCEL.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Processes:
EXCEL.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 776 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 776 EXCEL.EXE 776 EXCEL.EXE 776 EXCEL.EXE -
Suspicious use of WriteProcessMemory 35 IoCs
Processes:
EXCEL.EXEdescription pid process target process PID 776 wrote to memory of 524 776 EXCEL.EXE rundll32.exe PID 776 wrote to memory of 524 776 EXCEL.EXE rundll32.exe PID 776 wrote to memory of 524 776 EXCEL.EXE rundll32.exe PID 776 wrote to memory of 524 776 EXCEL.EXE rundll32.exe PID 776 wrote to memory of 524 776 EXCEL.EXE rundll32.exe PID 776 wrote to memory of 524 776 EXCEL.EXE rundll32.exe PID 776 wrote to memory of 524 776 EXCEL.EXE rundll32.exe PID 776 wrote to memory of 1648 776 EXCEL.EXE rundll32.exe PID 776 wrote to memory of 1648 776 EXCEL.EXE rundll32.exe PID 776 wrote to memory of 1648 776 EXCEL.EXE rundll32.exe PID 776 wrote to memory of 1648 776 EXCEL.EXE rundll32.exe PID 776 wrote to memory of 1648 776 EXCEL.EXE rundll32.exe PID 776 wrote to memory of 1648 776 EXCEL.EXE rundll32.exe PID 776 wrote to memory of 1648 776 EXCEL.EXE rundll32.exe PID 776 wrote to memory of 924 776 EXCEL.EXE rundll32.exe PID 776 wrote to memory of 924 776 EXCEL.EXE rundll32.exe PID 776 wrote to memory of 924 776 EXCEL.EXE rundll32.exe PID 776 wrote to memory of 924 776 EXCEL.EXE rundll32.exe PID 776 wrote to memory of 924 776 EXCEL.EXE rundll32.exe PID 776 wrote to memory of 924 776 EXCEL.EXE rundll32.exe PID 776 wrote to memory of 924 776 EXCEL.EXE rundll32.exe PID 776 wrote to memory of 836 776 EXCEL.EXE rundll32.exe PID 776 wrote to memory of 836 776 EXCEL.EXE rundll32.exe PID 776 wrote to memory of 836 776 EXCEL.EXE rundll32.exe PID 776 wrote to memory of 836 776 EXCEL.EXE rundll32.exe PID 776 wrote to memory of 836 776 EXCEL.EXE rundll32.exe PID 776 wrote to memory of 836 776 EXCEL.EXE rundll32.exe PID 776 wrote to memory of 836 776 EXCEL.EXE rundll32.exe PID 776 wrote to memory of 664 776 EXCEL.EXE rundll32.exe PID 776 wrote to memory of 664 776 EXCEL.EXE rundll32.exe PID 776 wrote to memory of 664 776 EXCEL.EXE rundll32.exe PID 776 wrote to memory of 664 776 EXCEL.EXE rundll32.exe PID 776 wrote to memory of 664 776 EXCEL.EXE rundll32.exe PID 776 wrote to memory of 664 776 EXCEL.EXE rundll32.exe PID 776 wrote to memory of 664 776 EXCEL.EXE rundll32.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\Debt-Details-1318148499-03052021.xls1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32 ..\Vijaser.lasjr,DllRegisterServer2⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32 ..\Vijaser.lasjr1,DllRegisterServer2⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32 ..\Vijaser.lasjr2,DllRegisterServer2⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32 ..\Vijaser.lasjr3,DllRegisterServer2⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32 ..\Vijaser.lasjr4,DllRegisterServer2⤵
- Process spawned unexpected child process
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/524-6-0x0000000000000000-mapping.dmp
-
memory/524-7-0x0000000075C61000-0x0000000075C63000-memory.dmpFilesize
8KB
-
memory/664-14-0x0000000000000000-mapping.dmp
-
memory/776-2-0x000000002F5C1000-0x000000002F5C4000-memory.dmpFilesize
12KB
-
memory/776-3-0x0000000071191000-0x0000000071193000-memory.dmpFilesize
8KB
-
memory/776-4-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/836-12-0x0000000000000000-mapping.dmp
-
memory/924-10-0x0000000000000000-mapping.dmp
-
memory/1648-8-0x0000000000000000-mapping.dmp
-
memory/1808-5-0x000007FEF72E0000-0x000007FEF755A000-memory.dmpFilesize
2.5MB