Analysis
- max time kernel
110s - max time network
124s - platform
windows10_x64 - resource
win10-en-20211104 - submitted
01/12/2021, 19:34
Static task
static1
Behavioral task
behavioral1
Sample
plans_48055147646.xls
Resource
win7-en-20211014
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
plans_48055147646.xls
Resource
win10-en-20211104
windows10_x64
0 signatures
0 seconds
General
- Target plans_48055147646.xls
- Size 136KB
- Sample211201-x94phafcep
- SHA256 8aa75d5cf72e1fd0282c2b33e53d79b1fe84080aeebccbfd63ba947834af4cc3
- MD5 ff88069068413d77f1cc92da5ad0abad
- SHA1 08902275c9dbe38d6b7e550c34eb57cda731530f
- SHA512 c0f81063d04a2e436124eb779909dc7bb59cd986faff7d120e4c1b9b6b382141d9b5e9a564312a7d6a1f535edbba6d59ea05a76fd8ba8d4958779082eba7ef5e
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3760 2016 wmic.exe 67 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2188 1352 mshta.exe 68 - Blocklisted process makes network request 1 IoCs
flow pid Process 42 2188 mshta.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2016 EXCEL.EXE - Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3760 wmic.exe Token: SeSecurityPrivilege 3760 wmic.exe Token: SeTakeOwnershipPrivilege 3760 wmic.exe Token: SeLoadDriverPrivilege 3760 wmic.exe Token: SeSystemProfilePrivilege 3760 wmic.exe Token: SeSystemtimePrivilege 3760 wmic.exe Token: SeProfSingleProcessPrivilege 3760 wmic.exe Token: SeIncBasePriorityPrivilege 3760 wmic.exe Token: SeCreatePagefilePrivilege 3760 wmic.exe Token: SeBackupPrivilege 3760 wmic.exe Token: SeRestorePrivilege 3760 wmic.exe Token: SeShutdownPrivilege 3760 wmic.exe Token: SeDebugPrivilege 3760 wmic.exe Token: SeSystemEnvironmentPrivilege 3760 wmic.exe Token: SeRemoteShutdownPrivilege 3760 wmic.exe Token: SeUndockPrivilege 3760 wmic.exe Token: SeManageVolumePrivilege 3760 wmic.exe Token: 33 3760 wmic.exe Token: 34 3760 wmic.exe Token: 35 3760 wmic.exe Token: 36 3760 wmic.exe Token: SeIncreaseQuotaPrivilege 3760 wmic.exe Token: SeSecurityPrivilege 3760 wmic.exe Token: SeTakeOwnershipPrivilege 3760 wmic.exe Token: SeLoadDriverPrivilege 3760 wmic.exe Token: SeSystemProfilePrivilege 3760 wmic.exe Token: SeSystemtimePrivilege 3760 wmic.exe Token: SeProfSingleProcessPrivilege 3760 wmic.exe Token: SeIncBasePriorityPrivilege 3760 wmic.exe Token: SeCreatePagefilePrivilege 3760 wmic.exe Token: SeBackupPrivilege 3760 wmic.exe Token: SeRestorePrivilege 3760 wmic.exe Token: SeShutdownPrivilege 3760 wmic.exe Token: SeDebugPrivilege 3760 wmic.exe Token: SeSystemEnvironmentPrivilege 3760 wmic.exe Token: SeRemoteShutdownPrivilege 3760 wmic.exe Token: SeUndockPrivilege 3760 wmic.exe Token: SeManageVolumePrivilege 3760 wmic.exe Token: 33 3760 wmic.exe Token: 34 3760 wmic.exe Token: 35 3760 wmic.exe Token: 36 3760 wmic.exe - Suspicious use of SetWindowsHookEx 16 IoCs
pid Process 2016 EXCEL.EXE 2016 EXCEL.EXE 2016 EXCEL.EXE 2016 EXCEL.EXE 2016 EXCEL.EXE 2016 EXCEL.EXE 2016 EXCEL.EXE 2016 EXCEL.EXE 2016 EXCEL.EXE 2016 EXCEL.EXE 2016 EXCEL.EXE 2016 EXCEL.EXE 2016 EXCEL.EXE 2016 EXCEL.EXE 2016 EXCEL.EXE 2016 EXCEL.EXE - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2016 wrote to memory of 3760 2016 EXCEL.EXE 73 PID 2016 wrote to memory of 3760 2016 EXCEL.EXE 73
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\plans_48055147646.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\System32\Wbem\wmic.exewmic process call create "mshta C:\ProgramData\oiwVrqxryIcO.rtf"2⤵
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
PID:3760
-
-
C:\Windows\system32\mshta.exemshta C:\ProgramData\oiwVrqxryIcO.rtf1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
PID:2188