Resubmissions
09-12-2021 18:02
211209-wmrwraeefm 1009-12-2021 13:54
211209-q7h7fsdecm 1007-12-2021 10:30
211207-mjt29sggaq 10Analysis
-
max time kernel
123s -
max time network
133s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
09-12-2021 13:54
Behavioral task
behavioral1
Sample
inv856837915323.xlsb
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
inv856837915323.xlsb
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
inv856837915323.xlsb
-
Size
79KB
-
MD5
a8b05f0781be741710594ec8616540c7
-
SHA1
fac6283173d33ac0ec42603afbf7c0af18bf7bee
-
SHA256
30a27f834183c2c94d01d18838bed678f78aa07a09ba5cd1aec57416ef18a43e
-
SHA512
907ce01a72b4cd2909f6647f4b555119ac03d52bafd06c10417e065c2653338f95fb491658a553137616e4cc5bb82f42df4eb8485c2435c7d20cf29e07bdac42
Score
10/10
Malware Config
Signatures
-
Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 2736 2732 wmic.exe 67 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2276 3256 explorer.exe 74 -
Blocklisted process makes network request 1 IoCs
flow pid Process 45 2908 WScript.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings explorer.exe -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 45 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2732 EXCEL.EXE -
Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2736 wmic.exe Token: SeSecurityPrivilege 2736 wmic.exe Token: SeTakeOwnershipPrivilege 2736 wmic.exe Token: SeLoadDriverPrivilege 2736 wmic.exe Token: SeSystemProfilePrivilege 2736 wmic.exe Token: SeSystemtimePrivilege 2736 wmic.exe Token: SeProfSingleProcessPrivilege 2736 wmic.exe Token: SeIncBasePriorityPrivilege 2736 wmic.exe Token: SeCreatePagefilePrivilege 2736 wmic.exe Token: SeBackupPrivilege 2736 wmic.exe Token: SeRestorePrivilege 2736 wmic.exe Token: SeShutdownPrivilege 2736 wmic.exe Token: SeDebugPrivilege 2736 wmic.exe Token: SeSystemEnvironmentPrivilege 2736 wmic.exe Token: SeRemoteShutdownPrivilege 2736 wmic.exe Token: SeUndockPrivilege 2736 wmic.exe Token: SeManageVolumePrivilege 2736 wmic.exe Token: 33 2736 wmic.exe Token: 34 2736 wmic.exe Token: 35 2736 wmic.exe Token: 36 2736 wmic.exe Token: SeIncreaseQuotaPrivilege 2736 wmic.exe Token: SeSecurityPrivilege 2736 wmic.exe Token: SeTakeOwnershipPrivilege 2736 wmic.exe Token: SeLoadDriverPrivilege 2736 wmic.exe Token: SeSystemProfilePrivilege 2736 wmic.exe Token: SeSystemtimePrivilege 2736 wmic.exe Token: SeProfSingleProcessPrivilege 2736 wmic.exe Token: SeIncBasePriorityPrivilege 2736 wmic.exe Token: SeCreatePagefilePrivilege 2736 wmic.exe Token: SeBackupPrivilege 2736 wmic.exe Token: SeRestorePrivilege 2736 wmic.exe Token: SeShutdownPrivilege 2736 wmic.exe Token: SeDebugPrivilege 2736 wmic.exe Token: SeSystemEnvironmentPrivilege 2736 wmic.exe Token: SeRemoteShutdownPrivilege 2736 wmic.exe Token: SeUndockPrivilege 2736 wmic.exe Token: SeManageVolumePrivilege 2736 wmic.exe Token: 33 2736 wmic.exe Token: 34 2736 wmic.exe Token: 35 2736 wmic.exe Token: 36 2736 wmic.exe -
Suspicious use of SetWindowsHookEx 15 IoCs
pid Process 2732 EXCEL.EXE 2732 EXCEL.EXE 2732 EXCEL.EXE 2732 EXCEL.EXE 2732 EXCEL.EXE 2732 EXCEL.EXE 2732 EXCEL.EXE 2732 EXCEL.EXE 2732 EXCEL.EXE 2732 EXCEL.EXE 2732 EXCEL.EXE 2732 EXCEL.EXE 2732 EXCEL.EXE 2732 EXCEL.EXE 2732 EXCEL.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2732 wrote to memory of 2736 2732 EXCEL.EXE 72 PID 2732 wrote to memory of 2736 2732 EXCEL.EXE 72 PID 3536 wrote to memory of 2908 3536 explorer.exe 77 PID 3536 wrote to memory of 2908 3536 explorer.exe 77
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\inv856837915323.xlsb"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\System32\Wbem\wmic.exewmic process call create "explorer C:\ProgramData\IeVgaFSGRUxioNf.vbs"2⤵
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
PID:2736
-
-
C:\Windows\explorer.exeexplorer C:\ProgramData\IeVgaFSGRUxioNf.vbs1⤵
- Process spawned unexpected child process
PID:2276
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\ProgramData\IeVgaFSGRUxioNf.vbs"2⤵
- Blocklisted process makes network request
PID:2908
-