Analysis
-
max time kernel
89s -
max time network
137s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
14-07-2021 02:36
Behavioral task
behavioral1
Sample
subscription_1617291613.xlsb
Resource
win7v20210408
General
-
Target
subscription_1617291613.xlsb
-
Size
228KB
-
MD5
8a3364bafa63166394862068b05f5469
-
SHA1
b039cb7a479cf118d53c61e113ad74015caadd22
-
SHA256
3d0b681046147d8008b70bab97c41e3a21a283559874ac2ce0c518b6965312da
-
SHA512
27c70c7fd278222a17112c0e3deb16a84f36f080a6fd933d51c4cc73392654414991ae0ba99e9760008c40a865572380c03a3b3af9297cb1a3678c630ca18111
Malware Config
Extracted
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 2304 4036 cmd.exe EXCEL.EXE -
Nloader Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1304-277-0x0000000003250000-0x0000000003255000-memory.dmp nloader -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 1304 rundll32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2344 1304 WerFault.exe rundll32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 4036 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
WerFault.exepid process 2344 WerFault.exe 2344 WerFault.exe 2344 WerFault.exe 2344 WerFault.exe 2344 WerFault.exe 2344 WerFault.exe 2344 WerFault.exe 2344 WerFault.exe 2344 WerFault.exe 2344 WerFault.exe 2344 WerFault.exe 2344 WerFault.exe 2344 WerFault.exe 2344 WerFault.exe 2344 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 2344 WerFault.exe Token: SeBackupPrivilege 2344 WerFault.exe Token: SeDebugPrivilege 2344 WerFault.exe -
Suspicious use of SetWindowsHookEx 17 IoCs
Processes:
EXCEL.EXEpid process 4036 EXCEL.EXE 4036 EXCEL.EXE 4036 EXCEL.EXE 4036 EXCEL.EXE 4036 EXCEL.EXE 4036 EXCEL.EXE 4036 EXCEL.EXE 4036 EXCEL.EXE 4036 EXCEL.EXE 4036 EXCEL.EXE 4036 EXCEL.EXE 4036 EXCEL.EXE 4036 EXCEL.EXE 4036 EXCEL.EXE 4036 EXCEL.EXE 4036 EXCEL.EXE 4036 EXCEL.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
EXCEL.EXEcmd.exerundll32.exedescription pid process target process PID 4036 wrote to memory of 2304 4036 EXCEL.EXE cmd.exe PID 4036 wrote to memory of 2304 4036 EXCEL.EXE cmd.exe PID 2304 wrote to memory of 2020 2304 cmd.exe certutil.exe PID 2304 wrote to memory of 2020 2304 cmd.exe certutil.exe PID 2304 wrote to memory of 3808 2304 cmd.exe rundll32.exe PID 2304 wrote to memory of 3808 2304 cmd.exe rundll32.exe PID 3808 wrote to memory of 1304 3808 rundll32.exe rundll32.exe PID 3808 wrote to memory of 1304 3808 rundll32.exe rundll32.exe PID 3808 wrote to memory of 1304 3808 rundll32.exe rundll32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\subscription_1617291613.xlsb"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c certutil -decode %PUBLIC%\569390.pdi %PUBLIC%\569390.ui && rundll32 %PUBLIC%\569390.ui,DF12⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\system32\certutil.execertutil -decode C:\Users\Public\569390.pdi C:\Users\Public\569390.ui3⤵PID:2020
-
C:\Windows\system32\rundll32.exerundll32 C:\Users\Public\569390.ui,DF13⤵
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Windows\SysWOW64\rundll32.exerundll32 C:\Users\Public\569390.ui,DF14⤵
- Loads dropped DLL
PID:1304 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 8085⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2344
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
5cc5f895b91ab4c1835ac9b83e86663b
SHA1b51565a65b167172b71516435f4118ec9a278673
SHA25681a75221faf7f28e2b2ce76471499d72b94da9ae48e0e1dc5bf01060e9195065
SHA5123a4289acdc392d999f4edde46c4261956b9be0aba355dc730a7bee08b9b00dff8733f84c97365aa773fad8bde29aa8dc040aac3067e7af3e7f75049c897e08f0
-
MD5
f4dc5b1151ed77bfcfae8b73147d93c2
SHA1e53166ca0f09ad46795cd8f5a1c9a4a2d5b21415
SHA25671cd6cb93fcf508761b72fac05bc96a07697718eb928c72fc7731dab457b3606
SHA512077b54dc49c0596ead6b5f754c77deecbda5d7dfee34c21b3d5faab727c8a83804c7da4652597905f5428ab52f2cd10eabbbaae12e30d3a5ccebba0b4ce479eb
-
MD5
f4dc5b1151ed77bfcfae8b73147d93c2
SHA1e53166ca0f09ad46795cd8f5a1c9a4a2d5b21415
SHA25671cd6cb93fcf508761b72fac05bc96a07697718eb928c72fc7731dab457b3606
SHA512077b54dc49c0596ead6b5f754c77deecbda5d7dfee34c21b3d5faab727c8a83804c7da4652597905f5428ab52f2cd10eabbbaae12e30d3a5ccebba0b4ce479eb