Analysis
-
max time kernel
156s -
max time network
154s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
12-01-2022 18:44
Behavioral task
behavioral1
Sample
824524892.xlsm
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
824524892.xlsm
Resource
win10-en-20211208
General
-
Target
824524892.xlsm
-
Size
83KB
-
MD5
3a34a8f95b92bec1e9aefb1235d27dfd
-
SHA1
5aa96c293a519112b6453657c103add288a84cdf
-
SHA256
cce90115dbb29f91192ea44a98616dbd6b6f4a74e76c8eefe004edba731635b7
-
SHA512
dcaaac4a8cbcb8c2472bf015c3da35a3864424f809453fe3340e94e88d9ddeeb2a94321b4edf1ca07637b9ea593546a7b0d66626a588df4ace084afc1ce4fc48
Malware Config
Extracted
http://www.be-pu.com/4.hana/Y1XWpb1zWMRD/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rundll32.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3480 2060 rundll32.exe EXCEL.EXE -
Downloads MZ/PE file
-
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 3480 rundll32.exe 2696 rundll32.exe -
Drops file in System32 directory 1 IoCs
Processes:
rundll32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Rdqaanqzjf\wsdokrjervve.qlf rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 2060 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid process 2060 EXCEL.EXE 2060 EXCEL.EXE 2060 EXCEL.EXE 2060 EXCEL.EXE 2060 EXCEL.EXE 2060 EXCEL.EXE 2060 EXCEL.EXE 2060 EXCEL.EXE 2060 EXCEL.EXE 2060 EXCEL.EXE 2060 EXCEL.EXE 2060 EXCEL.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
EXCEL.EXErundll32.exerundll32.exedescription pid process target process PID 2060 wrote to memory of 3480 2060 EXCEL.EXE rundll32.exe PID 2060 wrote to memory of 3480 2060 EXCEL.EXE rundll32.exe PID 2060 wrote to memory of 3480 2060 EXCEL.EXE rundll32.exe PID 3480 wrote to memory of 2696 3480 rundll32.exe rundll32.exe PID 3480 wrote to memory of 2696 3480 rundll32.exe rundll32.exe PID 3480 wrote to memory of 2696 3480 rundll32.exe rundll32.exe PID 2696 wrote to memory of 4020 2696 rundll32.exe rundll32.exe PID 2696 wrote to memory of 4020 2696 rundll32.exe rundll32.exe PID 2696 wrote to memory of 4020 2696 rundll32.exe rundll32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\824524892.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\rundll32.exeC:\Windows\SysWow64\rundll32.exe ..\adi.ocx,D"&"l"&"lR"&"egister"&"Serve"&"r2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\adi.ocx",DllRegisterServer3⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Rdqaanqzjf\wsdokrjervve.qlf",FNBNxbWQPEXbwq4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\adi.ocxMD5
76dc489d0ea1bc0f35d3d0e7da139861
SHA13c4653a45d06717224ba7ab34dd4b1969141a938
SHA25617e14a479bb0eebf88b7d5eaddfa6d88a4c57b299d04191a315920ad8faafbcf
SHA512752bf51d88294209ca5ac0a1b93987aacda0fdef948bc93e393dcdb6b5e9848cdb3072dc46dec8cabba935463c03201fbf3ee5b68fb5771ae8bf9e853a1f3ca4
-
\Users\Admin\adi.ocxMD5
76dc489d0ea1bc0f35d3d0e7da139861
SHA13c4653a45d06717224ba7ab34dd4b1969141a938
SHA25617e14a479bb0eebf88b7d5eaddfa6d88a4c57b299d04191a315920ad8faafbcf
SHA512752bf51d88294209ca5ac0a1b93987aacda0fdef948bc93e393dcdb6b5e9848cdb3072dc46dec8cabba935463c03201fbf3ee5b68fb5771ae8bf9e853a1f3ca4
-
\Users\Admin\adi.ocxMD5
76dc489d0ea1bc0f35d3d0e7da139861
SHA13c4653a45d06717224ba7ab34dd4b1969141a938
SHA25617e14a479bb0eebf88b7d5eaddfa6d88a4c57b299d04191a315920ad8faafbcf
SHA512752bf51d88294209ca5ac0a1b93987aacda0fdef948bc93e393dcdb6b5e9848cdb3072dc46dec8cabba935463c03201fbf3ee5b68fb5771ae8bf9e853a1f3ca4
-
memory/2060-115-0x00007FFDEE7B0000-0x00007FFDEE7C0000-memory.dmpFilesize
64KB
-
memory/2060-116-0x00007FFDEE7B0000-0x00007FFDEE7C0000-memory.dmpFilesize
64KB
-
memory/2060-117-0x00007FFDEE7B0000-0x00007FFDEE7C0000-memory.dmpFilesize
64KB
-
memory/2060-118-0x00007FFDEE7B0000-0x00007FFDEE7C0000-memory.dmpFilesize
64KB
-
memory/2060-119-0x00007FFDEE7B0000-0x00007FFDEE7C0000-memory.dmpFilesize
64KB
-
memory/2060-120-0x0000028EAB0B0000-0x0000028EAB0B2000-memory.dmpFilesize
8KB
-
memory/2060-121-0x0000028EAB0B0000-0x0000028EAB0B2000-memory.dmpFilesize
8KB
-
memory/2060-122-0x0000028EAB0B0000-0x0000028EAB0B2000-memory.dmpFilesize
8KB
-
memory/2696-279-0x0000000000000000-mapping.dmp
-
memory/2696-283-0x00000000032E0000-0x000000000338E000-memory.dmpFilesize
696KB
-
memory/3480-278-0x0000000000C30000-0x0000000000D7A000-memory.dmpFilesize
1.3MB
-
memory/3480-269-0x0000000000000000-mapping.dmp
-
memory/4020-284-0x0000000000000000-mapping.dmp