Analysis
-
max time kernel
148s -
max time network
125s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
03-05-2021 17:05
Behavioral task
behavioral1
Sample
88da57ba_by_Libranalysis.xls
Resource
win7v20210410
Behavioral task
behavioral2
Sample
88da57ba_by_Libranalysis.xls
Resource
win10v20210408
General
-
Target
88da57ba_by_Libranalysis.xls
-
Size
293KB
-
MD5
88da57baad066838d62daa0d17658eb0
-
SHA1
c9d47b8cf3debfe3f714c6eb497829a8ad2bd1fc
-
SHA256
f82a3b15901da167017395e4158995302d01abbb9b7f259465eca8f66f42fb5c
-
SHA512
561401ec068bea4d1907ca81f66fceeb21d93fbca3e1fc1fafd6c68bc7df465dbaf988e4bbd8f38a54dceade57f12428b9ec20c5e5a43c45e4a1c662dc4919d0
Malware Config
Extracted
https://otusmail.com/b/vegas.dll
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rundll32.exedescription pid pid_target process target process Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 984 768 rundll32.exe EXCEL.EXE -
Downloads MZ/PE file
-
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 984 rundll32.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Processes:
EXCEL.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 768 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
EXCEL.EXEpid process 768 EXCEL.EXE 768 EXCEL.EXE 768 EXCEL.EXE 768 EXCEL.EXE 768 EXCEL.EXE 768 EXCEL.EXE 768 EXCEL.EXE -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
EXCEL.EXEdescription pid process target process PID 768 wrote to memory of 984 768 EXCEL.EXE rundll32.exe PID 768 wrote to memory of 984 768 EXCEL.EXE rundll32.exe PID 768 wrote to memory of 984 768 EXCEL.EXE rundll32.exe PID 768 wrote to memory of 984 768 EXCEL.EXE rundll32.exe PID 768 wrote to memory of 984 768 EXCEL.EXE rundll32.exe PID 768 wrote to memory of 984 768 EXCEL.EXE rundll32.exe PID 768 wrote to memory of 984 768 EXCEL.EXE rundll32.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\88da57ba_by_Libranalysis.xls1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32 ..\bsdnbsej.dbw,PluginInit2⤵
- Process spawned unexpected child process
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\bsdnbsej.dbwMD5
b80f4b91c29963df1cfd0d0a8a30e5c6
SHA109c6ae06e0c10672d91f6850118f41dc3dd66e72
SHA2560a87bd3bb60320b21e493341b70519af4e46c2e969038d6d89b536cd37aa11d9
SHA512bdcd3009ed3499055cf73ef1c4dd4bd0942c8b81c395cecf3c9da790e4867055059d10b05451476d7da98bbbf472c40536e7a09158b5de92c57a74e36396d10c
-
\Users\Admin\bsdnbsej.dbwMD5
b80f4b91c29963df1cfd0d0a8a30e5c6
SHA109c6ae06e0c10672d91f6850118f41dc3dd66e72
SHA2560a87bd3bb60320b21e493341b70519af4e46c2e969038d6d89b536cd37aa11d9
SHA512bdcd3009ed3499055cf73ef1c4dd4bd0942c8b81c395cecf3c9da790e4867055059d10b05451476d7da98bbbf472c40536e7a09158b5de92c57a74e36396d10c
-
memory/768-59-0x000000002F531000-0x000000002F534000-memory.dmpFilesize
12KB
-
memory/768-60-0x0000000071981000-0x0000000071983000-memory.dmpFilesize
8KB
-
memory/768-61-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/984-62-0x0000000000000000-mapping.dmp
-
memory/984-63-0x0000000075EF1000-0x0000000075EF3000-memory.dmpFilesize
8KB
-
memory/984-67-0x000000006C9B0000-0x000000006CB3C000-memory.dmpFilesize
1.5MB
-
memory/984-66-0x000000006C9B0000-0x000000006C9D8000-memory.dmpFilesize
160KB
-
memory/984-68-0x0000000000170000-0x0000000000171000-memory.dmpFilesize
4KB