Analysis
- max time kernel
151s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
11/02/2022, 22:07
Static task
static1
Behavioral task
behavioral1
Sample
agent2.xls
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
agent2.xls
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
- Target agent2.xls
- Size 36KB
- Sample220211-11mamsdcf7
- SHA256 b488e96e5403f73b44c169fa2dc9489444c01ac1e9400106be215b813609ab8a
- MD5 482ca668733925c391419fc7d4fd56ad
- SHA1 3fd18bb19a7815dee0d03be7a1d0759e3780e26e
- SHA512 b58871928bb405d5945ba10d3895a4959d1d56ad25f4d8cedb152acf381d84a3216798f4bbbaaafd63d526a808200bdbcd787f8c353a4f813aa7d893ca797b03
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 788 3272 explorer.exe 80 - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings explorer.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3272 EXCEL.EXE - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4436 svchost.exe Token: SeCreatePagefilePrivilege 4436 svchost.exe Token: SeShutdownPrivilege 4436 svchost.exe Token: SeCreatePagefilePrivilege 4436 svchost.exe Token: SeShutdownPrivilege 4436 svchost.exe Token: SeCreatePagefilePrivilege 4436 svchost.exe Token: SeSecurityPrivilege 5096 TiWorker.exe Token: SeRestorePrivilege 5096 TiWorker.exe Token: SeBackupPrivilege 5096 TiWorker.exe Token: SeBackupPrivilege 5096 TiWorker.exe Token: SeRestorePrivilege 5096 TiWorker.exe Token: SeSecurityPrivilege 5096 TiWorker.exe Token: SeBackupPrivilege 5096 TiWorker.exe Token: SeRestorePrivilege 5096 TiWorker.exe Token: SeSecurityPrivilege 5096 TiWorker.exe Token: SeBackupPrivilege 5096 TiWorker.exe Token: SeRestorePrivilege 5096 TiWorker.exe Token: SeSecurityPrivilege 5096 TiWorker.exe Token: SeBackupPrivilege 5096 TiWorker.exe Token: SeRestorePrivilege 5096 TiWorker.exe Token: SeSecurityPrivilege 5096 TiWorker.exe Token: SeBackupPrivilege 5096 TiWorker.exe Token: SeRestorePrivilege 5096 TiWorker.exe Token: SeSecurityPrivilege 5096 TiWorker.exe Token: SeBackupPrivilege 5096 TiWorker.exe Token: SeRestorePrivilege 5096 TiWorker.exe Token: SeSecurityPrivilege 5096 TiWorker.exe Token: SeBackupPrivilege 5096 TiWorker.exe Token: SeRestorePrivilege 5096 TiWorker.exe Token: SeSecurityPrivilege 5096 TiWorker.exe Token: SeBackupPrivilege 5096 TiWorker.exe Token: SeRestorePrivilege 5096 TiWorker.exe Token: SeSecurityPrivilege 5096 TiWorker.exe Token: SeBackupPrivilege 5096 TiWorker.exe Token: SeRestorePrivilege 5096 TiWorker.exe Token: SeSecurityPrivilege 5096 TiWorker.exe Token: SeBackupPrivilege 5096 TiWorker.exe Token: SeRestorePrivilege 5096 TiWorker.exe Token: SeSecurityPrivilege 5096 TiWorker.exe Token: SeBackupPrivilege 5096 TiWorker.exe Token: SeRestorePrivilege 5096 TiWorker.exe Token: SeSecurityPrivilege 5096 TiWorker.exe Token: SeBackupPrivilege 5096 TiWorker.exe Token: SeRestorePrivilege 5096 TiWorker.exe Token: SeSecurityPrivilege 5096 TiWorker.exe Token: SeBackupPrivilege 5096 TiWorker.exe Token: SeRestorePrivilege 5096 TiWorker.exe Token: SeSecurityPrivilege 5096 TiWorker.exe Token: SeBackupPrivilege 5096 TiWorker.exe Token: SeRestorePrivilege 5096 TiWorker.exe Token: SeSecurityPrivilege 5096 TiWorker.exe Token: SeBackupPrivilege 5096 TiWorker.exe Token: SeRestorePrivilege 5096 TiWorker.exe Token: SeSecurityPrivilege 5096 TiWorker.exe Token: SeBackupPrivilege 5096 TiWorker.exe Token: SeRestorePrivilege 5096 TiWorker.exe Token: SeSecurityPrivilege 5096 TiWorker.exe Token: SeBackupPrivilege 5096 TiWorker.exe Token: SeRestorePrivilege 5096 TiWorker.exe Token: SeSecurityPrivilege 5096 TiWorker.exe Token: SeBackupPrivilege 5096 TiWorker.exe Token: SeRestorePrivilege 5096 TiWorker.exe Token: SeSecurityPrivilege 5096 TiWorker.exe Token: SeBackupPrivilege 5096 TiWorker.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3272 EXCEL.EXE 3272 EXCEL.EXE - Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 3272 EXCEL.EXE 3272 EXCEL.EXE 3272 EXCEL.EXE 3272 EXCEL.EXE 3272 EXCEL.EXE 3272 EXCEL.EXE 3272 EXCEL.EXE 3272 EXCEL.EXE 3272 EXCEL.EXE 3272 EXCEL.EXE 3272 EXCEL.EXE 3272 EXCEL.EXE 3272 EXCEL.EXE 3272 EXCEL.EXE - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3272 wrote to memory of 788 3272 EXCEL.EXE 82 PID 3272 wrote to memory of 788 3272 EXCEL.EXE 82 PID 1048 wrote to memory of 4744 1048 explorer.exe 84 PID 1048 wrote to memory of 4744 1048 explorer.exe 84
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\agent2.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Windows\explorer.exeexplorer.exe C:\Users\Public\Documents\cNqssq9.vbs2⤵
- Process spawned unexpected child process
PID:788
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\cNqssq9.vbs"2⤵PID:4744
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4436
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5096