Analysis
-
max time kernel
111s -
max time network
141s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
21-04-2021 16:20
Static task
static1
Behavioral task
behavioral1
Sample
8bdcc1592ffaee9154ed4331a44fa52af3b2baebbd4ef71840adc73b38635d9e.xlsm
Resource
win7v20210408
General
-
Target
8bdcc1592ffaee9154ed4331a44fa52af3b2baebbd4ef71840adc73b38635d9e.xlsm
-
Size
155KB
-
MD5
77f482d7c33d70474d451cf2546f4b4f
-
SHA1
9ef86f2a8171e50ec5734886d895885280e029d8
-
SHA256
8bdcc1592ffaee9154ed4331a44fa52af3b2baebbd4ef71840adc73b38635d9e
-
SHA512
f656c8f2a14ddb066469f20ab5303f5a0ec18d17648e67a59fde4902dc923f5a70fe4cc4964251a705275e98073df76821ec6e3ee8d93982fb86ec71a698404a
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rundll32.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 2684 648 rundll32.exe EXCEL.EXE -
Downloads MZ/PE file
-
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 1488 rundll32.exe -
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 28 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 24 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 648 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid process 648 EXCEL.EXE 648 EXCEL.EXE 648 EXCEL.EXE 648 EXCEL.EXE 648 EXCEL.EXE 648 EXCEL.EXE 648 EXCEL.EXE 648 EXCEL.EXE 648 EXCEL.EXE 648 EXCEL.EXE 648 EXCEL.EXE 648 EXCEL.EXE -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
EXCEL.EXErundll32.exedescription pid process target process PID 648 wrote to memory of 2684 648 EXCEL.EXE rundll32.exe PID 648 wrote to memory of 2684 648 EXCEL.EXE rundll32.exe PID 2684 wrote to memory of 1488 2684 rundll32.exe rundll32.exe PID 2684 wrote to memory of 1488 2684 rundll32.exe rundll32.exe PID 2684 wrote to memory of 1488 2684 rundll32.exe rundll32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\8bdcc1592ffaee9154ed4331a44fa52af3b2baebbd4ef71840adc73b38635d9e.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Users\Admin\AppData\Roaming\43590..dll" JsVarAddRef2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Users\Admin\AppData\Roaming\43590..dll" JsVarAddRef3⤵
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\43590..dllMD5
d2f953ecea3887fb038b9e558a57de9d
SHA145382b0422906e4b9814ba29dc7482b2db02a77f
SHA25657404952b2214c55fe96d63d6ab6a7808151bd862eca2b98b76244308c1d0238
SHA512c38874a7e6592877430fec68692c491651fe49258e9a9db8ec0ca986736fbf326cca5a691697cc78a35abdc58649c9790b4e96e17559e62e29f567e8b9e5c02f
-
\Users\Admin\AppData\Roaming\43590..dllMD5
d2f953ecea3887fb038b9e558a57de9d
SHA145382b0422906e4b9814ba29dc7482b2db02a77f
SHA25657404952b2214c55fe96d63d6ab6a7808151bd862eca2b98b76244308c1d0238
SHA512c38874a7e6592877430fec68692c491651fe49258e9a9db8ec0ca986736fbf326cca5a691697cc78a35abdc58649c9790b4e96e17559e62e29f567e8b9e5c02f
-
memory/648-117-0x00007FFAC4B10000-0x00007FFAC4B20000-memory.dmpFilesize
64KB
-
memory/648-114-0x00007FF6BA880000-0x00007FF6BDE36000-memory.dmpFilesize
53.7MB
-
memory/648-118-0x00007FFAC4B10000-0x00007FFAC4B20000-memory.dmpFilesize
64KB
-
memory/648-121-0x00007FFAC4B10000-0x00007FFAC4B20000-memory.dmpFilesize
64KB
-
memory/648-122-0x00007FFAE52A0000-0x00007FFAE638E000-memory.dmpFilesize
16.9MB
-
memory/648-123-0x00007FFAE33A0000-0x00007FFAE5295000-memory.dmpFilesize
31.0MB
-
memory/648-116-0x00007FFAC4B10000-0x00007FFAC4B20000-memory.dmpFilesize
64KB
-
memory/648-115-0x00007FFAC4B10000-0x00007FFAC4B20000-memory.dmpFilesize
64KB
-
memory/1488-181-0x0000000000000000-mapping.dmp
-
memory/1488-183-0x0000000000D30000-0x0000000000D36000-memory.dmpFilesize
24KB
-
memory/2684-179-0x0000000000000000-mapping.dmp