Analysis
-
max time kernel
153s -
max time network
151s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
12-01-2022 04:12
Behavioral task
behavioral1
Sample
0f2bd22e41ca408211f2fcfbf4d05645.xls
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
0f2bd22e41ca408211f2fcfbf4d05645.xls
Resource
win10-en-20211208
General
-
Target
0f2bd22e41ca408211f2fcfbf4d05645.xls
-
Size
118KB
-
MD5
0f2bd22e41ca408211f2fcfbf4d05645
-
SHA1
e396920d9f3ddaa9c1c25325794dc1cc9d5d860f
-
SHA256
e58cd1fc646d37b9fd8040d9f7f4110bb07cbdadb1f5dd4a55413acacd33807d
-
SHA512
75de138b42573b73253ca721cc2727ffcf0e0ce4336866e8e952380b3749ec7064a65ae6984ecd0f3d00e8784f40a2e00fe00fd18b78a60b4b54e888aacdd3fb
Malware Config
Extracted
http://www.cuneytkocas.com/wp-content/VSnofpES1wO2CcVob/
http://towardsun.net/admin/BYGGkrYAnT/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rundll32.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 4836 344 rundll32.exe EXCEL.EXE -
Blocklisted process makes network request 2 IoCs
Processes:
rundll32.exeflow pid process 41 4848 rundll32.exe 47 4848 rundll32.exe -
Downloads MZ/PE file
-
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 4836 rundll32.exe 4872 rundll32.exe -
Drops file in System32 directory 1 IoCs
Processes:
rundll32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Uijptwbkpmkz\kjsdzqaszskmbn.slr rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 344 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 4848 rundll32.exe 4848 rundll32.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid process 344 EXCEL.EXE 344 EXCEL.EXE 344 EXCEL.EXE 344 EXCEL.EXE 344 EXCEL.EXE 344 EXCEL.EXE 344 EXCEL.EXE 344 EXCEL.EXE 344 EXCEL.EXE 344 EXCEL.EXE 344 EXCEL.EXE 344 EXCEL.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
EXCEL.EXErundll32.exerundll32.exerundll32.exedescription pid process target process PID 344 wrote to memory of 4836 344 EXCEL.EXE rundll32.exe PID 344 wrote to memory of 4836 344 EXCEL.EXE rundll32.exe PID 344 wrote to memory of 4836 344 EXCEL.EXE rundll32.exe PID 4836 wrote to memory of 4872 4836 rundll32.exe rundll32.exe PID 4836 wrote to memory of 4872 4836 rundll32.exe rundll32.exe PID 4836 wrote to memory of 4872 4836 rundll32.exe rundll32.exe PID 4872 wrote to memory of 4864 4872 rundll32.exe rundll32.exe PID 4872 wrote to memory of 4864 4872 rundll32.exe rundll32.exe PID 4872 wrote to memory of 4864 4872 rundll32.exe rundll32.exe PID 4864 wrote to memory of 4848 4864 rundll32.exe rundll32.exe PID 4864 wrote to memory of 4848 4864 rundll32.exe rundll32.exe PID 4864 wrote to memory of 4848 4864 rundll32.exe rundll32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\0f2bd22e41ca408211f2fcfbf4d05645.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:344 -
C:\Windows\SysWow64\rundll32.exeC:\Windows\SysWow64\rundll32.exe ..\sun.ocx,D"&"l"&"lR"&"egister"&"Serve"&"r2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\sun.ocx",DllRegisterServer3⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Uijptwbkpmkz\kjsdzqaszskmbn.slr",kSOQmjmwTPY4⤵
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Uijptwbkpmkz\kjsdzqaszskmbn.slr",DllRegisterServer5⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:4848
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
5c03637348efec3837962257e6c62247
SHA1a00ca90772f35f6ea760e522685c5877960665b6
SHA2567c621ec1eb8f988238d7ddd0ee8b6c0a056a4a46a34f79de378ab03efeecb3c5
SHA512dbfed71c4e72863138041abb951228d2e7ce385e18e10a4e883c2aceb7b16c7d5fb48cbb1f8d00b968943b647413b955aa988995f1d3aa7964616f72d8f868b1
-
MD5
5c03637348efec3837962257e6c62247
SHA1a00ca90772f35f6ea760e522685c5877960665b6
SHA2567c621ec1eb8f988238d7ddd0ee8b6c0a056a4a46a34f79de378ab03efeecb3c5
SHA512dbfed71c4e72863138041abb951228d2e7ce385e18e10a4e883c2aceb7b16c7d5fb48cbb1f8d00b968943b647413b955aa988995f1d3aa7964616f72d8f868b1
-
MD5
5c03637348efec3837962257e6c62247
SHA1a00ca90772f35f6ea760e522685c5877960665b6
SHA2567c621ec1eb8f988238d7ddd0ee8b6c0a056a4a46a34f79de378ab03efeecb3c5
SHA512dbfed71c4e72863138041abb951228d2e7ce385e18e10a4e883c2aceb7b16c7d5fb48cbb1f8d00b968943b647413b955aa988995f1d3aa7964616f72d8f868b1