1475636af6d42e5dc6fd8ac8e5a9850dcb6c0f041260dc6dfa705937db677799

General

Target

Copy of Invoice 7739588.xlsm
Size

396KB
MD5

0ebd66296b64dd6c70e7ed59d8736886
SHA1

20958d81ce924d8ed14e93078b5f661ee85cb263
SHA256

1475636af6d42e5dc6fd8ac8e5a9850dcb6c0f041260dc6dfa705937db677799
SHA512

49365bb54a02e58f0eb1ae9bfc6a020d2a4161ba2d34b350b45b55b985a4836b8756f0da1c880a51f872a18187840c9df5ed201993133c4134924558ab3136dd

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.

Processes:

wmic.exe

description pid pid_target process target process

Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1508 3296 wmic.exe
Blocklisted process makes network request 5 IoCs

Processes:

wmic.exe

flow pid process

33 1508 wmic.exe
35 1508 wmic.exe
37 1508 wmic.exe
39 1508 wmic.exe
40 1508 wmic.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1508	3296	wmic.exe

flow	pid	process
33	1508	wmic.exe
35	1508	wmic.exe
37	1508	wmic.exe
39	1508	wmic.exe
40	1508	wmic.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

3928 EXCEL.EXE

Suspicious use of AdjustPrivilegeToken 42 IoCs

Processes:

wmic.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1508	wmic.exe
Token: SeSecurityPrivilege	1508	wmic.exe
Token: SeTakeOwnershipPrivilege	1508	wmic.exe
Token: SeLoadDriverPrivilege	1508	wmic.exe
Token: SeSystemProfilePrivilege	1508	wmic.exe
Token: SeSystemtimePrivilege	1508	wmic.exe
Token: SeProfSingleProcessPrivilege	1508	wmic.exe
Token: SeIncBasePriorityPrivilege	1508	wmic.exe
Token: SeCreatePagefilePrivilege	1508	wmic.exe
Token: SeBackupPrivilege	1508	wmic.exe
Token: SeRestorePrivilege	1508	wmic.exe
Token: SeShutdownPrivilege	1508	wmic.exe
Token: SeDebugPrivilege	1508	wmic.exe
Token: SeSystemEnvironmentPrivilege	1508	wmic.exe
Token: SeRemoteShutdownPrivilege	1508	wmic.exe
Token: SeUndockPrivilege	1508	wmic.exe
Token: SeManageVolumePrivilege	1508	wmic.exe
Token: 33	1508	wmic.exe
Token: 34	1508	wmic.exe
Token: 35	1508	wmic.exe
Token: 36	1508	wmic.exe
Token: SeIncreaseQuotaPrivilege	1508	wmic.exe
Token: SeSecurityPrivilege	1508	wmic.exe
Token: SeTakeOwnershipPrivilege	1508	wmic.exe
Token: SeLoadDriverPrivilege	1508	wmic.exe
Token: SeSystemProfilePrivilege	1508	wmic.exe
Token: SeSystemtimePrivilege	1508	wmic.exe
Token: SeProfSingleProcessPrivilege	1508	wmic.exe
Token: SeIncBasePriorityPrivilege	1508	wmic.exe
Token: SeCreatePagefilePrivilege	1508	wmic.exe
Token: SeBackupPrivilege	1508	wmic.exe
Token: SeRestorePrivilege	1508	wmic.exe
Token: SeShutdownPrivilege	1508	wmic.exe
Token: SeDebugPrivilege	1508	wmic.exe
Token: SeSystemEnvironmentPrivilege	1508	wmic.exe
Token: SeRemoteShutdownPrivilege	1508	wmic.exe
Token: SeUndockPrivilege	1508	wmic.exe
Token: SeManageVolumePrivilege	1508	wmic.exe
Token: 33	1508	wmic.exe
Token: 34	1508	wmic.exe
Token: 35	1508	wmic.exe
Token: 36	1508	wmic.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

EXCEL.EXE

pid	process
3928	EXCEL.EXE
3928	EXCEL.EXE
3928	EXCEL.EXE
3928	EXCEL.EXE
3928	EXCEL.EXE
3928	EXCEL.EXE
3928	EXCEL.EXE
3928	EXCEL.EXE
3928	EXCEL.EXE
3928	EXCEL.EXE
3928	EXCEL.EXE
3928	EXCEL.EXE

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

wmic.exe

description pid process target process

PID 1508 wrote to memory of 1844 1508 wmic.exe rundll32.exe
PID 1508 wrote to memory of 1844 1508 wmic.exe rundll32.exe

description	pid	process	target process
PID 1508 wrote to memory of 1844	1508	wmic.exe	rundll32.exe
PID 1508 wrote to memory of 1844	1508	wmic.exe	rundll32.exe

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Copy of Invoice 7739588.xlsm"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3928

C:\Windows\system32\wbem\wmic.exe
wmic os get /format:"C:\Users\Admin\AppData\Roaming\20F89.xsl"
1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1508

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:/Windows/Temp//55i2l.dll JsRelease
2⤵
PID:1844

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

3

T1082

Query Registry

2

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\20F89.xsl
MD5
d606088a88b3d266af5807f62dfcefeb

SHA1
82a9ab249e6b248b5f2cc001e3433015d667d851

SHA256
9db0e34e26cdf39ec4ec17e62e8eb17c30b4fd87c588ddf51eb59279c4e46dce

SHA512
af88d213b8bb2d5bae4ae225dee2424e556e8150fac123c84a5eb5c64ba63b3f64dae781e1060532e372caf17413792e5539195de80e32d34d9baa3a4ec90121

Download Submit
C:\Windows\Temp\55i2l.dll
MD5
0357aa49ea850b11b99d09a2479c321b

SHA1
41472ba5c40f61fa1c77c42cf06248f13b8785f0

SHA256
0ff0b7fcb090c65d0bdcb2af4bbd2c30f33356b3ce9b117186fa20391ef840a3

SHA512
a317a0f035b8dff7ca60c76b0b75698a3528fd4c7c5e915292c982d2b38c1c937c318362c891e93bee6fdb1b166764d7183140a837fd23daa2be3d2dac5a5dfc

Download Submit
memory/1844-9-0x0000000000000000-mapping.dmp

Download
memory/3928-2-0x00007FF8C5770000-0x00007FF8C5780000-memory.dmp

Filesize
64KB

Download
memory/3928-3-0x00007FF8C5770000-0x00007FF8C5780000-memory.dmp

Filesize
64KB

Download
memory/3928-4-0x00007FF8C5770000-0x00007FF8C5780000-memory.dmp

Filesize
64KB

Download
memory/3928-5-0x00007FF8E8E40000-0x00007FF8E9477000-memory.dmp

Filesize
6.2MB

Download
memory/3928-6-0x00007FF8C5770000-0x00007FF8C5780000-memory.dmp

Filesize
64KB

Download
memory/3928-7-0x0000022A071D0000-0x0000022A071D4000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads