Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
15-01-2022 01:33
Behavioral task
behavioral1
Sample
b654e1b1f4906be1e6155ad03eba53894dfa66ba899732c7f4cacac7a98d1f6e.xlsm
Resource
win10-en-20211208
Behavioral task
behavioral2
Sample
b654e1b1f4906be1e6155ad03eba53894dfa66ba899732c7f4cacac7a98d1f6e.xlsm
Resource
win10-en-20211208
General
-
Target
b654e1b1f4906be1e6155ad03eba53894dfa66ba899732c7f4cacac7a98d1f6e.xlsm
-
Size
83KB
-
MD5
bdc6d97b7154f28cc5bfb7d95190a1fa
-
SHA1
37d3583e2cd06ebf7b6ec8768abb635c5a1dd3d9
-
SHA256
b654e1b1f4906be1e6155ad03eba53894dfa66ba899732c7f4cacac7a98d1f6e
-
SHA512
ad96e4126355d96c20fb777cb0ea4aaffe25423cd79b7c779e2b01fd4046c4135250d8273577a034390074dd9adea0dc6adf01313e72d2b89bbe481da29b2016
Malware Config
Extracted
https://zml.laneso.com/packet/AlvJ8OdtSYEeeCQP/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rundll32.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3068 2376 rundll32.exe EXCEL.EXE -
Blocklisted process makes network request 3 IoCs
Processes:
rundll32.exeflow pid process 45 2680 rundll32.exe 46 2680 rundll32.exe 47 2680 rundll32.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 3068 rundll32.exe 300 rundll32.exe -
Drops file in System32 directory 1 IoCs
Processes:
rundll32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Aygvlfsocrhf\xxmbimnoeq.jzd rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 2376 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 2680 rundll32.exe 2680 rundll32.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid process 2376 EXCEL.EXE 2376 EXCEL.EXE 2376 EXCEL.EXE 2376 EXCEL.EXE 2376 EXCEL.EXE 2376 EXCEL.EXE 2376 EXCEL.EXE 2376 EXCEL.EXE 2376 EXCEL.EXE 2376 EXCEL.EXE 2376 EXCEL.EXE 2376 EXCEL.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
EXCEL.EXErundll32.exerundll32.exerundll32.exedescription pid process target process PID 2376 wrote to memory of 3068 2376 EXCEL.EXE rundll32.exe PID 2376 wrote to memory of 3068 2376 EXCEL.EXE rundll32.exe PID 2376 wrote to memory of 3068 2376 EXCEL.EXE rundll32.exe PID 3068 wrote to memory of 300 3068 rundll32.exe rundll32.exe PID 3068 wrote to memory of 300 3068 rundll32.exe rundll32.exe PID 3068 wrote to memory of 300 3068 rundll32.exe rundll32.exe PID 300 wrote to memory of 3796 300 rundll32.exe rundll32.exe PID 300 wrote to memory of 3796 300 rundll32.exe rundll32.exe PID 300 wrote to memory of 3796 300 rundll32.exe rundll32.exe PID 3796 wrote to memory of 2680 3796 rundll32.exe rundll32.exe PID 3796 wrote to memory of 2680 3796 rundll32.exe rundll32.exe PID 3796 wrote to memory of 2680 3796 rundll32.exe rundll32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\b654e1b1f4906be1e6155ad03eba53894dfa66ba899732c7f4cacac7a98d1f6e.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\rundll32.exeC:\Windows\SysWow64\rundll32.exe ..\erum.ocx,D"&"l"&"lR"&"egister"&"Serve"&"r2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\erum.ocx",DllRegisterServer3⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Aygvlfsocrhf\xxmbimnoeq.jzd",EQrUosgCGTInEi4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Aygvlfsocrhf\xxmbimnoeq.jzd",DllRegisterServer5⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\erum.ocxMD5
27328645430fa569af2dae074dc75be1
SHA1641cbf374586ba3be921f58615ecdd4f7119d59e
SHA256e46e00f87034131210e2a8909c2819062858d0a42d6ca55273887831ccd4e9b1
SHA51283f7aa6fe9fb4d1ff268c5f8bdb57654dae0d8438e23935f516094647f842eab55de4872ac426229d0d5d5684dc69cba60e7a19e70e1f85122e889173b4b18d9
-
\Users\Admin\erum.ocxMD5
27328645430fa569af2dae074dc75be1
SHA1641cbf374586ba3be921f58615ecdd4f7119d59e
SHA256e46e00f87034131210e2a8909c2819062858d0a42d6ca55273887831ccd4e9b1
SHA51283f7aa6fe9fb4d1ff268c5f8bdb57654dae0d8438e23935f516094647f842eab55de4872ac426229d0d5d5684dc69cba60e7a19e70e1f85122e889173b4b18d9
-
\Users\Admin\erum.ocxMD5
27328645430fa569af2dae074dc75be1
SHA1641cbf374586ba3be921f58615ecdd4f7119d59e
SHA256e46e00f87034131210e2a8909c2819062858d0a42d6ca55273887831ccd4e9b1
SHA51283f7aa6fe9fb4d1ff268c5f8bdb57654dae0d8438e23935f516094647f842eab55de4872ac426229d0d5d5684dc69cba60e7a19e70e1f85122e889173b4b18d9
-
memory/300-263-0x0000000000000000-mapping.dmp
-
memory/2376-118-0x00007FFEFF1F0000-0x00007FFEFF200000-memory.dmpFilesize
64KB
-
memory/2376-119-0x000001EAEC7C0000-0x000001EAEC7C2000-memory.dmpFilesize
8KB
-
memory/2376-121-0x00007FFEFF1F0000-0x00007FFEFF200000-memory.dmpFilesize
64KB
-
memory/2376-122-0x000001EAEC7C0000-0x000001EAEC7C2000-memory.dmpFilesize
8KB
-
memory/2376-120-0x000001EAEC7C0000-0x000001EAEC7C2000-memory.dmpFilesize
8KB
-
memory/2376-115-0x00007FFEFF1F0000-0x00007FFEFF200000-memory.dmpFilesize
64KB
-
memory/2376-117-0x00007FFEFF1F0000-0x00007FFEFF200000-memory.dmpFilesize
64KB
-
memory/2376-116-0x00007FFEFF1F0000-0x00007FFEFF200000-memory.dmpFilesize
64KB
-
memory/2680-284-0x0000000000000000-mapping.dmp
-
memory/3068-258-0x0000000000000000-mapping.dmp
-
memory/3796-281-0x0000000000000000-mapping.dmp