Resubmissions
09-12-2021 18:02
211209-wmrwraeefm 1009-12-2021 13:54
211209-q7h7fsdecm 1007-12-2021 10:30
211207-mjt29sggaq 10Analysis
-
max time kernel
129s -
max time network
139s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
09-12-2021 18:02
Behavioral task
behavioral1
Sample
inv856837915323.xlsb
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
inv856837915323.xlsb
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
inv856837915323.xlsb
-
Size
79KB
-
MD5
a8b05f0781be741710594ec8616540c7
-
SHA1
fac6283173d33ac0ec42603afbf7c0af18bf7bee
-
SHA256
30a27f834183c2c94d01d18838bed678f78aa07a09ba5cd1aec57416ef18a43e
-
SHA512
907ce01a72b4cd2909f6647f4b555119ac03d52bafd06c10417e065c2653338f95fb491658a553137616e4cc5bb82f42df4eb8485c2435c7d20cf29e07bdac42
Score
10/10
Malware Config
Signatures
-
Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3760 2724 wmic.exe 67 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1460 988 explorer.exe 75 -
Blocklisted process makes network request 1 IoCs
flow pid Process 45 3676 WScript.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings explorer.exe -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 45 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2724 EXCEL.EXE -
Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3760 wmic.exe Token: SeSecurityPrivilege 3760 wmic.exe Token: SeTakeOwnershipPrivilege 3760 wmic.exe Token: SeLoadDriverPrivilege 3760 wmic.exe Token: SeSystemProfilePrivilege 3760 wmic.exe Token: SeSystemtimePrivilege 3760 wmic.exe Token: SeProfSingleProcessPrivilege 3760 wmic.exe Token: SeIncBasePriorityPrivilege 3760 wmic.exe Token: SeCreatePagefilePrivilege 3760 wmic.exe Token: SeBackupPrivilege 3760 wmic.exe Token: SeRestorePrivilege 3760 wmic.exe Token: SeShutdownPrivilege 3760 wmic.exe Token: SeDebugPrivilege 3760 wmic.exe Token: SeSystemEnvironmentPrivilege 3760 wmic.exe Token: SeRemoteShutdownPrivilege 3760 wmic.exe Token: SeUndockPrivilege 3760 wmic.exe Token: SeManageVolumePrivilege 3760 wmic.exe Token: 33 3760 wmic.exe Token: 34 3760 wmic.exe Token: 35 3760 wmic.exe Token: 36 3760 wmic.exe Token: SeIncreaseQuotaPrivilege 3760 wmic.exe Token: SeSecurityPrivilege 3760 wmic.exe Token: SeTakeOwnershipPrivilege 3760 wmic.exe Token: SeLoadDriverPrivilege 3760 wmic.exe Token: SeSystemProfilePrivilege 3760 wmic.exe Token: SeSystemtimePrivilege 3760 wmic.exe Token: SeProfSingleProcessPrivilege 3760 wmic.exe Token: SeIncBasePriorityPrivilege 3760 wmic.exe Token: SeCreatePagefilePrivilege 3760 wmic.exe Token: SeBackupPrivilege 3760 wmic.exe Token: SeRestorePrivilege 3760 wmic.exe Token: SeShutdownPrivilege 3760 wmic.exe Token: SeDebugPrivilege 3760 wmic.exe Token: SeSystemEnvironmentPrivilege 3760 wmic.exe Token: SeRemoteShutdownPrivilege 3760 wmic.exe Token: SeUndockPrivilege 3760 wmic.exe Token: SeManageVolumePrivilege 3760 wmic.exe Token: 33 3760 wmic.exe Token: 34 3760 wmic.exe Token: 35 3760 wmic.exe Token: 36 3760 wmic.exe -
Suspicious use of SetWindowsHookEx 15 IoCs
pid Process 2724 EXCEL.EXE 2724 EXCEL.EXE 2724 EXCEL.EXE 2724 EXCEL.EXE 2724 EXCEL.EXE 2724 EXCEL.EXE 2724 EXCEL.EXE 2724 EXCEL.EXE 2724 EXCEL.EXE 2724 EXCEL.EXE 2724 EXCEL.EXE 2724 EXCEL.EXE 2724 EXCEL.EXE 2724 EXCEL.EXE 2724 EXCEL.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2724 wrote to memory of 3760 2724 EXCEL.EXE 73 PID 2724 wrote to memory of 3760 2724 EXCEL.EXE 73 PID 3420 wrote to memory of 3676 3420 explorer.exe 78 PID 3420 wrote to memory of 3676 3420 explorer.exe 78
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\inv856837915323.xlsb"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\System32\Wbem\wmic.exewmic process call create "explorer C:\ProgramData\IeVgaFSGRUxioNf.vbs"2⤵
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
PID:3760
-
-
C:\Windows\explorer.exeexplorer C:\ProgramData\IeVgaFSGRUxioNf.vbs1⤵
- Process spawned unexpected child process
PID:1460
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\ProgramData\IeVgaFSGRUxioNf.vbs"2⤵
- Blocklisted process makes network request
PID:3676
-