Analysis
-
max time kernel
151s -
max time network
136s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
12-01-2022 11:06
Behavioral task
behavioral1
Sample
IVSG-5.xlsm
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
IVSG-5.xlsm
Resource
win10-en-20211208
General
-
Target
IVSG-5.xlsm
-
Size
83KB
-
MD5
87c6c7d48700f1d10564840e9db0ee5a
-
SHA1
dc4ab236d49a710ba727cc5e8e0fca7511a028e3
-
SHA256
c4d0f3ae42ee96525f7c0b08e3e7eab28f6560c351b324b2926d0e74cd8c004c
-
SHA512
c41c1282a2c1d2c7a44ec1f625a3d3ca18fa4e7fbb52261df589d78e5a3c8da35f6a2715175d56fbf368d58569a8f55695a9777ea53ca5c75ce8173f00e2dc3d
Malware Config
Extracted
http://unifiedpharma.com/wp-admin/ildi5K2aTIrdvEobQ/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rundll32.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 2252 2692 rundll32.exe EXCEL.EXE -
Downloads MZ/PE file
-
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 2252 rundll32.exe 1252 rundll32.exe -
Drops file in System32 directory 1 IoCs
Processes:
rundll32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Berorssbk\ptcaggzrtu.eha rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 2692 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid process 2692 EXCEL.EXE 2692 EXCEL.EXE 2692 EXCEL.EXE 2692 EXCEL.EXE 2692 EXCEL.EXE 2692 EXCEL.EXE 2692 EXCEL.EXE 2692 EXCEL.EXE 2692 EXCEL.EXE 2692 EXCEL.EXE 2692 EXCEL.EXE 2692 EXCEL.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
EXCEL.EXErundll32.exerundll32.exerundll32.exedescription pid process target process PID 2692 wrote to memory of 2252 2692 EXCEL.EXE rundll32.exe PID 2692 wrote to memory of 2252 2692 EXCEL.EXE rundll32.exe PID 2692 wrote to memory of 2252 2692 EXCEL.EXE rundll32.exe PID 2252 wrote to memory of 1252 2252 rundll32.exe rundll32.exe PID 2252 wrote to memory of 1252 2252 rundll32.exe rundll32.exe PID 2252 wrote to memory of 1252 2252 rundll32.exe rundll32.exe PID 1252 wrote to memory of 2580 1252 rundll32.exe rundll32.exe PID 1252 wrote to memory of 2580 1252 rundll32.exe rundll32.exe PID 1252 wrote to memory of 2580 1252 rundll32.exe rundll32.exe PID 2580 wrote to memory of 196 2580 rundll32.exe rundll32.exe PID 2580 wrote to memory of 196 2580 rundll32.exe rundll32.exe PID 2580 wrote to memory of 196 2580 rundll32.exe rundll32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\IVSG-5.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\rundll32.exeC:\Windows\SysWow64\rundll32.exe ..\adi.ocx,D"&"l"&"lR"&"egister"&"Serve"&"r2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\adi.ocx",DllRegisterServer3⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Berorssbk\ptcaggzrtu.eha",mYuNvEMHQsW4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Berorssbk\ptcaggzrtu.eha",DllRegisterServer5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\adi.ocxMD5
7d54f698edaee76ebb4c87075431023c
SHA170544ec4ed73886433696bd522b51390548d2cbc
SHA25606402593fe37fe22af26c694efc5c1a69a5ceb803ebc7e2fa7dc612c732ba085
SHA5128d244544d00e61367fb7f0bfc3c4afb5b11fd747006c6e29ade9852df67214450fc7ce5b2d5da82336e5f65d5424a854ceaf691b8aec4654c0cfdb1d1adc8177
-
\Users\Admin\adi.ocxMD5
7d54f698edaee76ebb4c87075431023c
SHA170544ec4ed73886433696bd522b51390548d2cbc
SHA25606402593fe37fe22af26c694efc5c1a69a5ceb803ebc7e2fa7dc612c732ba085
SHA5128d244544d00e61367fb7f0bfc3c4afb5b11fd747006c6e29ade9852df67214450fc7ce5b2d5da82336e5f65d5424a854ceaf691b8aec4654c0cfdb1d1adc8177
-
\Users\Admin\adi.ocxMD5
7d54f698edaee76ebb4c87075431023c
SHA170544ec4ed73886433696bd522b51390548d2cbc
SHA25606402593fe37fe22af26c694efc5c1a69a5ceb803ebc7e2fa7dc612c732ba085
SHA5128d244544d00e61367fb7f0bfc3c4afb5b11fd747006c6e29ade9852df67214450fc7ce5b2d5da82336e5f65d5424a854ceaf691b8aec4654c0cfdb1d1adc8177
-
memory/196-269-0x0000000000000000-mapping.dmp
-
memory/1252-267-0x00000000044F0000-0x0000000004519000-memory.dmpFilesize
164KB
-
memory/1252-264-0x0000000000000000-mapping.dmp
-
memory/2252-259-0x0000000000000000-mapping.dmp
-
memory/2252-266-0x0000000004190000-0x00000000041B9000-memory.dmpFilesize
164KB
-
memory/2580-268-0x0000000000000000-mapping.dmp
-
memory/2580-270-0x00000000030E0000-0x0000000003109000-memory.dmpFilesize
164KB
-
memory/2692-126-0x00007FFD72FE0000-0x00007FFD72FF0000-memory.dmpFilesize
64KB
-
memory/2692-114-0x00007FFD72FE0000-0x00007FFD72FF0000-memory.dmpFilesize
64KB
-
memory/2692-120-0x000001F734CF0000-0x000001F734CF2000-memory.dmpFilesize
8KB
-
memory/2692-118-0x000001F734CF0000-0x000001F734CF2000-memory.dmpFilesize
8KB
-
memory/2692-119-0x000001F734CF0000-0x000001F734CF2000-memory.dmpFilesize
8KB
-
memory/2692-117-0x00007FFD72FE0000-0x00007FFD72FF0000-memory.dmpFilesize
64KB
-
memory/2692-116-0x00007FFD72FE0000-0x00007FFD72FF0000-memory.dmpFilesize
64KB
-
memory/2692-115-0x00007FFD72FE0000-0x00007FFD72FF0000-memory.dmpFilesize
64KB