Analysis
-
max time kernel
142s -
max time network
145s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
05-05-2021 17:04
Static task
static1
General
-
Target
sample.xlsm
-
Size
83KB
-
MD5
bb6fc5f43fe2e829d3cad6f5b906046f
-
SHA1
8a2b0c47801d6817d2b6021516623a2d9c6542fa
-
SHA256
806cbd4bab7e77c8a90661c5f92d347ac3e6ba869f1ff1f7b27c5e289ff105ff
-
SHA512
4a6d83cf5cfd788ddba7a15dfb7396805552c816cb6f615b87101b22789e8b1e1032799f1be1f8110f9ef89f6688e3b8476f95916b37eb6901fe3aa39a214bf3
Malware Config
Signatures
-
Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rundll32.exerundll32.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3288 3212 rundll32.exe EXCEL.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3396 3212 rundll32.exe EXCEL.EXE -
Downloads MZ/PE file
-
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 3464 rundll32.exe 1300 rundll32.exe -
Processes:
rundll32.exerundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE -
Script User-Agent 3 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 37 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 33 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 35 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 3212 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid process 3212 EXCEL.EXE 3212 EXCEL.EXE 3212 EXCEL.EXE 3212 EXCEL.EXE 3212 EXCEL.EXE 3212 EXCEL.EXE 3212 EXCEL.EXE 3212 EXCEL.EXE 3212 EXCEL.EXE 3212 EXCEL.EXE 3212 EXCEL.EXE 3212 EXCEL.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
EXCEL.EXErundll32.exerundll32.exedescription pid process target process PID 3212 wrote to memory of 3288 3212 EXCEL.EXE rundll32.exe PID 3212 wrote to memory of 3288 3212 EXCEL.EXE rundll32.exe PID 3288 wrote to memory of 3464 3288 rundll32.exe rundll32.exe PID 3288 wrote to memory of 3464 3288 rundll32.exe rundll32.exe PID 3288 wrote to memory of 3464 3288 rundll32.exe rundll32.exe PID 3212 wrote to memory of 3396 3212 EXCEL.EXE rundll32.exe PID 3212 wrote to memory of 3396 3212 EXCEL.EXE rundll32.exe PID 3396 wrote to memory of 1300 3396 rundll32.exe rundll32.exe PID 3396 wrote to memory of 1300 3396 rundll32.exe rundll32.exe PID 3396 wrote to memory of 1300 3396 rundll32.exe rundll32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\sample.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Users\Admin\AppData\Roaming\44481.dll" CreateBitmap2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Users\Admin\AppData\Roaming\44481.dll" CreateBitmap3⤵
- Loads dropped DLL
- Checks whether UAC is enabled
PID:3464 -
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Users\Admin\AppData\Roaming\44481.dll" CreateBitmap2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Users\Admin\AppData\Roaming\44481.dll" CreateBitmap3⤵
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1300
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\44481.dllMD5
c505932ab5535135d29f2be31104c6af
SHA1780402b58ba39204b723b971c1a96e7bddd5853c
SHA25688de18ad32abb5e100d5accc9c571c004c4283d17e46deb2043325d8179295ea
SHA512582bbda02df889b7c70dc2de273a45ff9912afd63cdd990bfb5ab6044d3f1993f95379eb75e7762aba7cee41b0d03c2f96d04cbe5561677b26c5386e34219156
-
\Users\Admin\AppData\Roaming\44481.dllMD5
c505932ab5535135d29f2be31104c6af
SHA1780402b58ba39204b723b971c1a96e7bddd5853c
SHA25688de18ad32abb5e100d5accc9c571c004c4283d17e46deb2043325d8179295ea
SHA512582bbda02df889b7c70dc2de273a45ff9912afd63cdd990bfb5ab6044d3f1993f95379eb75e7762aba7cee41b0d03c2f96d04cbe5561677b26c5386e34219156
-
\Users\Admin\AppData\Roaming\44481.dllMD5
c505932ab5535135d29f2be31104c6af
SHA1780402b58ba39204b723b971c1a96e7bddd5853c
SHA25688de18ad32abb5e100d5accc9c571c004c4283d17e46deb2043325d8179295ea
SHA512582bbda02df889b7c70dc2de273a45ff9912afd63cdd990bfb5ab6044d3f1993f95379eb75e7762aba7cee41b0d03c2f96d04cbe5561677b26c5386e34219156
-
memory/1300-185-0x0000000000000000-mapping.dmp
-
memory/3212-118-0x00007FF8383E0000-0x00007FF8383F0000-memory.dmpFilesize
64KB
-
memory/3212-122-0x00007FF8383E0000-0x00007FF8383F0000-memory.dmpFilesize
64KB
-
memory/3212-121-0x00007FF858E00000-0x00007FF859EEE000-memory.dmpFilesize
16.9MB
-
memory/3212-123-0x000001CBB4050000-0x000001CBB5F45000-memory.dmpFilesize
31.0MB
-
memory/3212-179-0x000001CBC7A80000-0x000001CBC7A84000-memory.dmpFilesize
16KB
-
memory/3212-114-0x00007FF7E1D00000-0x00007FF7E52B6000-memory.dmpFilesize
53.7MB
-
memory/3212-117-0x00007FF8383E0000-0x00007FF8383F0000-memory.dmpFilesize
64KB
-
memory/3212-116-0x00007FF8383E0000-0x00007FF8383F0000-memory.dmpFilesize
64KB
-
memory/3212-115-0x00007FF8383E0000-0x00007FF8383F0000-memory.dmpFilesize
64KB
-
memory/3288-180-0x0000000000000000-mapping.dmp
-
memory/3396-184-0x0000000000000000-mapping.dmp
-
memory/3464-182-0x0000000000000000-mapping.dmp
-
memory/3464-187-0x0000000004A40000-0x0000000004A46000-memory.dmpFilesize
24KB