Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
14-01-2022 16:13
Behavioral task
behavioral1
Sample
689555499fd2dff9a85acca987cf63ecb004150fb9428e7336b11a90eed8a4a6.xlsm
Resource
win10-en-20211208
Behavioral task
behavioral2
Sample
689555499fd2dff9a85acca987cf63ecb004150fb9428e7336b11a90eed8a4a6.xlsm
Resource
win10-en-20211208
General
-
Target
689555499fd2dff9a85acca987cf63ecb004150fb9428e7336b11a90eed8a4a6.xlsm
-
Size
83KB
-
MD5
a19739c3b8b42e530b0c39885a7eb572
-
SHA1
034d7b56335bc65f1010c24801f40f739f981418
-
SHA256
689555499fd2dff9a85acca987cf63ecb004150fb9428e7336b11a90eed8a4a6
-
SHA512
30cda33c13a7c5cbee38fc74846b6263ca20efc53434577855032e59f1e4376675d9f46b804e61964713d91fe7af8f9bcd3ffe010ebeec4461e45c38ea6c7238
Malware Config
Extracted
http://therecyclingmachine.com/wp-admin/LzpOZSlkq90fYT1/
http://zhongmaifangwu.com/TEST777/3U4Un0u/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3864 432 rundll32.exe 68 -
Blocklisted process makes network request 2 IoCs
flow pid Process 46 2760 rundll32.exe 47 2760 rundll32.exe -
Downloads MZ/PE file
-
Loads dropped DLL 2 IoCs
pid Process 3864 rundll32.exe 1356 rundll32.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Khdfilvmfbui\kwpcurqdm.ked rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 432 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2760 rundll32.exe 2760 rundll32.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 432 EXCEL.EXE 432 EXCEL.EXE 432 EXCEL.EXE 432 EXCEL.EXE 432 EXCEL.EXE 432 EXCEL.EXE 432 EXCEL.EXE 432 EXCEL.EXE 432 EXCEL.EXE 432 EXCEL.EXE 432 EXCEL.EXE 432 EXCEL.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 432 wrote to memory of 3864 432 EXCEL.EXE 74 PID 432 wrote to memory of 3864 432 EXCEL.EXE 74 PID 432 wrote to memory of 3864 432 EXCEL.EXE 74 PID 3864 wrote to memory of 1356 3864 rundll32.exe 75 PID 3864 wrote to memory of 1356 3864 rundll32.exe 75 PID 3864 wrote to memory of 1356 3864 rundll32.exe 75 PID 1356 wrote to memory of 3536 1356 rundll32.exe 76 PID 1356 wrote to memory of 3536 1356 rundll32.exe 76 PID 1356 wrote to memory of 3536 1356 rundll32.exe 76 PID 3536 wrote to memory of 2760 3536 rundll32.exe 77 PID 3536 wrote to memory of 2760 3536 rundll32.exe 77 PID 3536 wrote to memory of 2760 3536 rundll32.exe 77
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\689555499fd2dff9a85acca987cf63ecb004150fb9428e7336b11a90eed8a4a6.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Windows\SysWow64\rundll32.exeC:\Windows\SysWow64\rundll32.exe ..\erum.ocx,D"&"l"&"lR"&"egister"&"Serve"&"r2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\erum.ocx",DllRegisterServer3⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Khdfilvmfbui\kwpcurqdm.ked",PAQlEawylYXLFph4⤵
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Khdfilvmfbui\kwpcurqdm.ked",DllRegisterServer5⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:2760
-
-
-
-