Analysis
-
max time kernel
102s -
max time network
131s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09-03-2021 22:02
Behavioral task
behavioral1
Sample
Private file #3741119.xls
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
-
Target
Private file #3741119.xls
-
Size
90KB
-
MD5
764d3e3bf1bd4c9fe1a06e6c7ce511cd
-
SHA1
95e56031bf5ddb9b5aeed9e9f1d2d92410f69490
-
SHA256
ddd23286a06e4a24ae80188fd959f6f1aff568c133c27e74b5ff98b14695ff70
-
SHA512
5008a03926dd1420883ca172dc2dd28c6cb807813a38ceb16630742a35b1fad83a4014e829e811d13f3538df993cb59f869438992b6b9de152f44eff04565b14
Malware Config
Extracted
Family
buer
C2
miyfandecompany.com
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 1344 896 wmic.exe 67 -
Buer Loader 1 IoCs
Detects Buer loader in memory or disk.
resource yara_rule behavioral2/memory/3400-13-0x0000000040000000-0x000000004000A000-memory.dmp buer -
Executes dropped EXE 2 IoCs
pid Process 3960 neiq.auw 3400 neiq.auw -
Loads dropped DLL 1 IoCs
pid Process 3960 neiq.auw -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3960 set thread context of 3400 3960 neiq.auw 86 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NSIS installer 6 IoCs
resource yara_rule behavioral2/files/0x0002000000015616-8.dat nsis_installer_1 behavioral2/files/0x0002000000015616-8.dat nsis_installer_2 behavioral2/files/0x0002000000015616-9.dat nsis_installer_1 behavioral2/files/0x0002000000015616-9.dat nsis_installer_2 behavioral2/files/0x0002000000015616-12.dat nsis_installer_1 behavioral2/files/0x0002000000015616-12.dat nsis_installer_2 -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 896 EXCEL.EXE -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3960 neiq.auw -
Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1344 wmic.exe Token: SeSecurityPrivilege 1344 wmic.exe Token: SeTakeOwnershipPrivilege 1344 wmic.exe Token: SeLoadDriverPrivilege 1344 wmic.exe Token: SeSystemProfilePrivilege 1344 wmic.exe Token: SeSystemtimePrivilege 1344 wmic.exe Token: SeProfSingleProcessPrivilege 1344 wmic.exe Token: SeIncBasePriorityPrivilege 1344 wmic.exe Token: SeCreatePagefilePrivilege 1344 wmic.exe Token: SeBackupPrivilege 1344 wmic.exe Token: SeRestorePrivilege 1344 wmic.exe Token: SeShutdownPrivilege 1344 wmic.exe Token: SeDebugPrivilege 1344 wmic.exe Token: SeSystemEnvironmentPrivilege 1344 wmic.exe Token: SeRemoteShutdownPrivilege 1344 wmic.exe Token: SeUndockPrivilege 1344 wmic.exe Token: SeManageVolumePrivilege 1344 wmic.exe Token: 33 1344 wmic.exe Token: 34 1344 wmic.exe Token: 35 1344 wmic.exe Token: 36 1344 wmic.exe Token: SeIncreaseQuotaPrivilege 1344 wmic.exe Token: SeSecurityPrivilege 1344 wmic.exe Token: SeTakeOwnershipPrivilege 1344 wmic.exe Token: SeLoadDriverPrivilege 1344 wmic.exe Token: SeSystemProfilePrivilege 1344 wmic.exe Token: SeSystemtimePrivilege 1344 wmic.exe Token: SeProfSingleProcessPrivilege 1344 wmic.exe Token: SeIncBasePriorityPrivilege 1344 wmic.exe Token: SeCreatePagefilePrivilege 1344 wmic.exe Token: SeBackupPrivilege 1344 wmic.exe Token: SeRestorePrivilege 1344 wmic.exe Token: SeShutdownPrivilege 1344 wmic.exe Token: SeDebugPrivilege 1344 wmic.exe Token: SeSystemEnvironmentPrivilege 1344 wmic.exe Token: SeRemoteShutdownPrivilege 1344 wmic.exe Token: SeUndockPrivilege 1344 wmic.exe Token: SeManageVolumePrivilege 1344 wmic.exe Token: 33 1344 wmic.exe Token: 34 1344 wmic.exe Token: 35 1344 wmic.exe Token: 36 1344 wmic.exe -
Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 896 EXCEL.EXE 896 EXCEL.EXE 896 EXCEL.EXE 896 EXCEL.EXE 896 EXCEL.EXE 896 EXCEL.EXE 896 EXCEL.EXE 896 EXCEL.EXE 896 EXCEL.EXE 896 EXCEL.EXE 896 EXCEL.EXE 896 EXCEL.EXE 896 EXCEL.EXE 896 EXCEL.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 896 wrote to memory of 1344 896 EXCEL.EXE 77 PID 896 wrote to memory of 1344 896 EXCEL.EXE 77 PID 3960 wrote to memory of 3400 3960 neiq.auw 86 PID 3960 wrote to memory of 3400 3960 neiq.auw 86 PID 3960 wrote to memory of 3400 3960 neiq.auw 86 PID 3960 wrote to memory of 3400 3960 neiq.auw 86
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Private file #3741119.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Windows\System32\Wbem\wmic.exewmic.exe process call create C:\Users\Public\neiq.auw2⤵
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
PID:1344
-
-
C:\Users\Public\neiq.auwC:\Users\Public\neiq.auw1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Public\neiq.auwC:\Users\Public\neiq.auw2⤵
- Executes dropped EXE
PID:3400
-