Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
19-07-2021 02:16
Static task
static1
Behavioral task
behavioral1
Sample
PO202107.xls
Resource
win7v20210408
General
-
Target
PO202107.xls
-
Size
23KB
-
MD5
c9123fe2a9ea247a974641a32940335b
-
SHA1
13c5be04c9afceb11892f27767d7bc45c33b4b9c
-
SHA256
bf19534d31541387c22c69963c679114bac4315d83e1dd3dc7b775b7dd377658
-
SHA512
a87babeac9c10faa19d638b7f02551eeab7f17b2f482bdf1a797d616b52995b5e326758a32d7a1418baab596ff1dfecf142dcd1ab8ca6cd8386c863f8984ba0c
Malware Config
Extracted
formbook
4.1
http://www.tiktokblueprints.com/ea9e/
yoga-fertilite.com
zcltlfsh.icu
aberdareroyalcottages.com
kawaiibobateahouse.com
311gang.com
coastalbreezecreations.com
globosimpresoss.com
ignitioniq.com
5gplaystation.com
marketopiniononline.com
martinstantondesigns.com
ksdhxtkpup4.net
findconscious.com
pure-tab.com
orderanthonysofskippack.com
findingthecurve.com
e-devletim.com
prosystemwebsite.com
travelbroom.com
sharpopinion.com
musclebuildingschool.com
prochoice-limo.com
xxgjmall.com
spoiltgirl.com
carpetcleaningmeridian.com
robertomiceli.com
leqi166.com
kaloncosmetx.com
siheontech.com
zunoki.com
egohui.pro
singjolt.com
shiqiangjn.com
ideaofis.com
wallet-invest.com
suitsnladders.com
pleasanthomestay.com
gametrue.online
sufferer-uncontroverted.info
riversidecahomes.com
kjfuli8.com
hottype.xyz
7958699.com
tijebei.com
animef.net
miraterratravel.com
lyon-de.com
psm-gen.com
discoveryaccess.xyz
nails-und-beauty.com
perfectkode.com
bieniek.one
1933ejaniceway.com
scholarlyleadership.com
alpinefloristnj.com
gsbkdz.com
vidtutor.com
willflosolutions.com
solongastheyfear.com
nexi-id.info
msglowrca.com
ulubeyismerkezi.com
valhallastables.net
coreadvices.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/748-74-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/748-75-0x000000000041ED80-mapping.dmp formbook behavioral1/memory/668-86-0x00000000000D0000-0x00000000000FE000-memory.dmp formbook -
Executes dropped EXE 2 IoCs
Processes:
PO202107PO202107pid process 1892 PO202107 748 PO202107 -
Loads dropped DLL 2 IoCs
Processes:
EXCEL.EXEPO202107pid process 1948 EXCEL.EXE 1892 PO202107 -
Suspicious use of SetThreadContext 4 IoCs
Processes:
PO202107PO202107msdt.exedescription pid process target process PID 1892 set thread context of 748 1892 PO202107 PO202107 PID 748 set thread context of 1208 748 PO202107 Explorer.EXE PID 748 set thread context of 1208 748 PO202107 Explorer.EXE PID 668 set thread context of 1208 668 msdt.exe Explorer.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Processes:
EXCEL.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1948 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
PO202107msdt.exepid process 748 PO202107 748 PO202107 748 PO202107 668 msdt.exe 668 msdt.exe 668 msdt.exe 668 msdt.exe 668 msdt.exe 668 msdt.exe 668 msdt.exe 668 msdt.exe 668 msdt.exe 668 msdt.exe 668 msdt.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1208 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
PO202107msdt.exepid process 748 PO202107 748 PO202107 748 PO202107 748 PO202107 668 msdt.exe 668 msdt.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
PO202107msdt.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 748 PO202107 Token: SeDebugPrivilege 668 msdt.exe Token: SeShutdownPrivilege 1208 Explorer.EXE Token: SeShutdownPrivilege 1208 Explorer.EXE Token: SeShutdownPrivilege 1208 Explorer.EXE Token: SeShutdownPrivilege 1208 Explorer.EXE Token: SeShutdownPrivilege 1208 Explorer.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1948 EXCEL.EXE 1948 EXCEL.EXE 1948 EXCEL.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
EXCEL.EXEPO202107PO202107msdt.exedescription pid process target process PID 1948 wrote to memory of 1892 1948 EXCEL.EXE PO202107 PID 1948 wrote to memory of 1892 1948 EXCEL.EXE PO202107 PID 1948 wrote to memory of 1892 1948 EXCEL.EXE PO202107 PID 1948 wrote to memory of 1892 1948 EXCEL.EXE PO202107 PID 1892 wrote to memory of 748 1892 PO202107 PO202107 PID 1892 wrote to memory of 748 1892 PO202107 PO202107 PID 1892 wrote to memory of 748 1892 PO202107 PO202107 PID 1892 wrote to memory of 748 1892 PO202107 PO202107 PID 1892 wrote to memory of 748 1892 PO202107 PO202107 PID 1892 wrote to memory of 748 1892 PO202107 PO202107 PID 1892 wrote to memory of 748 1892 PO202107 PO202107 PID 748 wrote to memory of 668 748 PO202107 msdt.exe PID 748 wrote to memory of 668 748 PO202107 msdt.exe PID 748 wrote to memory of 668 748 PO202107 msdt.exe PID 748 wrote to memory of 668 748 PO202107 msdt.exe PID 668 wrote to memory of 1820 668 msdt.exe cmd.exe PID 668 wrote to memory of 1820 668 msdt.exe cmd.exe PID 668 wrote to memory of 1820 668 msdt.exe cmd.exe PID 668 wrote to memory of 1820 668 msdt.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\PO202107.xls2⤵
- Loads dropped DLL
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO202107C:\Users\Admin\AppData\Local\Temp/PO2021073⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO202107"C:\Users\Admin\AppData\Local\Temp\PO202107"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"5⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO202107"6⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\PO202107MD5
081f5f42ff8f75d52ca942383d097028
SHA18382c3a28ab790b7090f25cb5b7259638b57cb5c
SHA256e99179189d603b5fe86e06f80326ff9716c05825a47c4c0dfecc5d9b3429d917
SHA5129dff362902911c57bf1430c14765d866aa7d1803f9fc0ee0e7f37751c14dacc6c8cbcab3044e48bff77fd59090dde996559e303bbf51418d54205cfb75b50f2f
-
C:\Users\Admin\AppData\Local\Temp\PO202107MD5
081f5f42ff8f75d52ca942383d097028
SHA18382c3a28ab790b7090f25cb5b7259638b57cb5c
SHA256e99179189d603b5fe86e06f80326ff9716c05825a47c4c0dfecc5d9b3429d917
SHA5129dff362902911c57bf1430c14765d866aa7d1803f9fc0ee0e7f37751c14dacc6c8cbcab3044e48bff77fd59090dde996559e303bbf51418d54205cfb75b50f2f
-
C:\Users\Admin\AppData\Local\Temp\PO202107MD5
081f5f42ff8f75d52ca942383d097028
SHA18382c3a28ab790b7090f25cb5b7259638b57cb5c
SHA256e99179189d603b5fe86e06f80326ff9716c05825a47c4c0dfecc5d9b3429d917
SHA5129dff362902911c57bf1430c14765d866aa7d1803f9fc0ee0e7f37751c14dacc6c8cbcab3044e48bff77fd59090dde996559e303bbf51418d54205cfb75b50f2f
-
\Users\Admin\AppData\Local\Temp\PO202107MD5
081f5f42ff8f75d52ca942383d097028
SHA18382c3a28ab790b7090f25cb5b7259638b57cb5c
SHA256e99179189d603b5fe86e06f80326ff9716c05825a47c4c0dfecc5d9b3429d917
SHA5129dff362902911c57bf1430c14765d866aa7d1803f9fc0ee0e7f37751c14dacc6c8cbcab3044e48bff77fd59090dde996559e303bbf51418d54205cfb75b50f2f
-
\Users\Admin\AppData\Local\Temp\PO202107MD5
081f5f42ff8f75d52ca942383d097028
SHA18382c3a28ab790b7090f25cb5b7259638b57cb5c
SHA256e99179189d603b5fe86e06f80326ff9716c05825a47c4c0dfecc5d9b3429d917
SHA5129dff362902911c57bf1430c14765d866aa7d1803f9fc0ee0e7f37751c14dacc6c8cbcab3044e48bff77fd59090dde996559e303bbf51418d54205cfb75b50f2f
-
memory/668-89-0x0000000002060000-0x00000000020F3000-memory.dmpFilesize
588KB
-
memory/668-85-0x0000000000AC0000-0x0000000000BB4000-memory.dmpFilesize
976KB
-
memory/668-87-0x0000000002320000-0x0000000002623000-memory.dmpFilesize
3.0MB
-
memory/668-86-0x00000000000D0000-0x00000000000FE000-memory.dmpFilesize
184KB
-
memory/668-83-0x0000000075511000-0x0000000075513000-memory.dmpFilesize
8KB
-
memory/668-82-0x0000000000000000-mapping.dmp
-
memory/748-75-0x000000000041ED80-mapping.dmp
-
memory/748-77-0x0000000000A90000-0x0000000000D93000-memory.dmpFilesize
3.0MB
-
memory/748-74-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/748-80-0x0000000000190000-0x00000000001A4000-memory.dmpFilesize
80KB
-
memory/748-78-0x0000000000140000-0x0000000000154000-memory.dmpFilesize
80KB
-
memory/1208-81-0x0000000006150000-0x0000000006251000-memory.dmpFilesize
1.0MB
-
memory/1208-79-0x00000000044A0000-0x000000000457F000-memory.dmpFilesize
892KB
-
memory/1208-90-0x0000000003B20000-0x0000000003BED000-memory.dmpFilesize
820KB
-
memory/1820-84-0x0000000000000000-mapping.dmp
-
memory/1892-72-0x0000000000540000-0x0000000000570000-memory.dmpFilesize
192KB
-
memory/1892-70-0x00000000004A0000-0x00000000004B1000-memory.dmpFilesize
68KB
-
memory/1892-69-0x0000000002020000-0x0000000002021000-memory.dmpFilesize
4KB
-
memory/1892-71-0x0000000005150000-0x00000000051C5000-memory.dmpFilesize
468KB
-
memory/1892-67-0x00000000009C0000-0x00000000009C1000-memory.dmpFilesize
4KB
-
memory/1892-64-0x0000000000000000-mapping.dmp
-
memory/1948-62-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1948-88-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1948-61-0x0000000070FB1000-0x0000000070FB3000-memory.dmpFilesize
8KB
-
memory/1948-60-0x000000002FB51000-0x000000002FB54000-memory.dmpFilesize
12KB