Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
13-01-2022 19:55
Behavioral task
behavioral1
Sample
0fdebd51c10306d56bd1555cc2467ae166b662318767f4913f57c930dfb4be05.xlsm
Resource
win10-en-20211208
Behavioral task
behavioral2
Sample
0fdebd51c10306d56bd1555cc2467ae166b662318767f4913f57c930dfb4be05.xlsm
Resource
win10-en-20211208
General
-
Target
0fdebd51c10306d56bd1555cc2467ae166b662318767f4913f57c930dfb4be05.xlsm
-
Size
84KB
-
MD5
07b04849e0e6e2eac4d82ddace0ff848
-
SHA1
7e9d3eeb8e71916eb8bae191df937bca616e0291
-
SHA256
0fdebd51c10306d56bd1555cc2467ae166b662318767f4913f57c930dfb4be05
-
SHA512
22a8c86f3f7db54c5eba2a292645f50efe658963ac896dd70d34b3e7864b0b10f7ade28c1d37ecc16dcd80900ea68b618369c36ad370f6bb9d022491e3b22e43
Malware Config
Extracted
http://auto.lambolero.com/f1nygync/J18Keqh/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 1444 1120 rundll32.exe 68 -
Downloads MZ/PE file
-
Loads dropped DLL 1 IoCs
pid Process 1444 rundll32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 3780 1444 WerFault.exe 72 -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1120 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 3780 WerFault.exe 3780 WerFault.exe 3780 WerFault.exe 3780 WerFault.exe 3780 WerFault.exe 3780 WerFault.exe 3780 WerFault.exe 3780 WerFault.exe 3780 WerFault.exe 3780 WerFault.exe 3780 WerFault.exe 3780 WerFault.exe 3780 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 3780 WerFault.exe Token: SeBackupPrivilege 3780 WerFault.exe Token: SeDebugPrivilege 3780 WerFault.exe -
Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 1120 EXCEL.EXE 1120 EXCEL.EXE 1120 EXCEL.EXE 1120 EXCEL.EXE 1120 EXCEL.EXE 1120 EXCEL.EXE 1120 EXCEL.EXE 1120 EXCEL.EXE 1120 EXCEL.EXE 1120 EXCEL.EXE 1120 EXCEL.EXE 1120 EXCEL.EXE 1120 EXCEL.EXE 1120 EXCEL.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1120 wrote to memory of 1444 1120 EXCEL.EXE 72 PID 1120 wrote to memory of 1444 1120 EXCEL.EXE 72 PID 1120 wrote to memory of 1444 1120 EXCEL.EXE 72
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\0fdebd51c10306d56bd1555cc2467ae166b662318767f4913f57c930dfb4be05.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Windows\SysWow64\rundll32.exeC:\Windows\SysWow64\rundll32.exe ..\einl.ocx,D"&"l"&"lR"&"egister"&"Serve"&"r2⤵
- Process spawned unexpected child process
- Loads dropped DLL
PID:1444 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1444 -s 6163⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3780
-
-