Analysis
-
max time kernel
151s -
max time network
134s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
13-01-2022 22:28
Behavioral task
behavioral1
Sample
096504811c78492132ac12b84ad2a6ee435ac882bd0a59bed69a1b10775edf37.xlsm
Resource
win10-en-20211208
Behavioral task
behavioral2
Sample
096504811c78492132ac12b84ad2a6ee435ac882bd0a59bed69a1b10775edf37.xlsm
Resource
win10-en-20211208
General
-
Target
096504811c78492132ac12b84ad2a6ee435ac882bd0a59bed69a1b10775edf37.xlsm
-
Size
83KB
-
MD5
5683076d4912043d209e4456df72457c
-
SHA1
2176256f3f12b3b3252334f58c656123a9d95178
-
SHA256
096504811c78492132ac12b84ad2a6ee435ac882bd0a59bed69a1b10775edf37
-
SHA512
ecec970884e861525a48fec9d50cf2d159e4aa81c382dce7a1903201e427f7ff4e1f3a909268c39e95f43f9f01e62f6721987d17664929e34c3df3df2e5e29ba
Malware Config
Extracted
http://robotically.xyz/wp-content/XtKkx/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 2392 4092 rundll32.exe 68 -
Blocklisted process makes network request 2 IoCs
flow pid Process 45 8 rundll32.exe 46 8 rundll32.exe -
Downloads MZ/PE file
-
Loads dropped DLL 2 IoCs
pid Process 2392 rundll32.exe 3064 rundll32.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Dtapzjpori\fujcdterjgtqlrp.pxw rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4092 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 8 rundll32.exe 8 rundll32.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 4092 EXCEL.EXE 4092 EXCEL.EXE 4092 EXCEL.EXE 4092 EXCEL.EXE 4092 EXCEL.EXE 4092 EXCEL.EXE 4092 EXCEL.EXE 4092 EXCEL.EXE 4092 EXCEL.EXE 4092 EXCEL.EXE 4092 EXCEL.EXE 4092 EXCEL.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4092 wrote to memory of 2392 4092 EXCEL.EXE 70 PID 4092 wrote to memory of 2392 4092 EXCEL.EXE 70 PID 4092 wrote to memory of 2392 4092 EXCEL.EXE 70 PID 2392 wrote to memory of 3064 2392 rundll32.exe 71 PID 2392 wrote to memory of 3064 2392 rundll32.exe 71 PID 2392 wrote to memory of 3064 2392 rundll32.exe 71 PID 3064 wrote to memory of 3228 3064 rundll32.exe 73 PID 3064 wrote to memory of 3228 3064 rundll32.exe 73 PID 3064 wrote to memory of 3228 3064 rundll32.exe 73 PID 3228 wrote to memory of 8 3228 rundll32.exe 74 PID 3228 wrote to memory of 8 3228 rundll32.exe 74 PID 3228 wrote to memory of 8 3228 rundll32.exe 74
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\096504811c78492132ac12b84ad2a6ee435ac882bd0a59bed69a1b10775edf37.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Windows\SysWow64\rundll32.exeC:\Windows\SysWow64\rundll32.exe ..\wxeu.ocx,D"&"l"&"lR"&"egister"&"Serve"&"r2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\wxeu.ocx",DllRegisterServer3⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Dtapzjpori\fujcdterjgtqlrp.pxw",hdTbPDqrhxMg4⤵
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Dtapzjpori\fujcdterjgtqlrp.pxw",DllRegisterServer5⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:8
-
-
-
-