Analysis
-
max time kernel
146s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
11-02-2022 18:02
Static task
static1
Behavioral task
behavioral1
Sample
TW0091.xlsx
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
TW0091.xlsx
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
TW0091.xlsx
-
Size
187KB
-
MD5
41521b74c54998dcd1460d444b07c5f1
-
SHA1
29dcf07f9964a0c2a36defa2935441f559fe7cd2
-
SHA256
91cf449506a9c3ade639027f6a38e99ee22d9cc7c2a1c4bc42fc8047185b8918
-
SHA512
8841ddad3690fb1c1436331b03ac26a356f0ff32ab5df923770da4af94785ee5d73cf0f68367cdb2bd3c31922f8be8726004e737753b11c9b32959f71155466d
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1740 EXCEL.EXE -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3448 svchost.exe Token: SeCreatePagefilePrivilege 3448 svchost.exe Token: SeShutdownPrivilege 3448 svchost.exe Token: SeCreatePagefilePrivilege 3448 svchost.exe Token: SeShutdownPrivilege 3448 svchost.exe Token: SeCreatePagefilePrivilege 3448 svchost.exe Token: SeSecurityPrivilege 1836 TiWorker.exe Token: SeRestorePrivilege 1836 TiWorker.exe Token: SeBackupPrivilege 1836 TiWorker.exe Token: SeBackupPrivilege 1836 TiWorker.exe Token: SeRestorePrivilege 1836 TiWorker.exe Token: SeSecurityPrivilege 1836 TiWorker.exe Token: SeBackupPrivilege 1836 TiWorker.exe Token: SeRestorePrivilege 1836 TiWorker.exe Token: SeSecurityPrivilege 1836 TiWorker.exe Token: SeBackupPrivilege 1836 TiWorker.exe Token: SeRestorePrivilege 1836 TiWorker.exe Token: SeSecurityPrivilege 1836 TiWorker.exe Token: SeBackupPrivilege 1836 TiWorker.exe Token: SeRestorePrivilege 1836 TiWorker.exe Token: SeSecurityPrivilege 1836 TiWorker.exe Token: SeBackupPrivilege 1836 TiWorker.exe Token: SeRestorePrivilege 1836 TiWorker.exe Token: SeSecurityPrivilege 1836 TiWorker.exe Token: SeBackupPrivilege 1836 TiWorker.exe Token: SeRestorePrivilege 1836 TiWorker.exe Token: SeSecurityPrivilege 1836 TiWorker.exe Token: SeBackupPrivilege 1836 TiWorker.exe Token: SeRestorePrivilege 1836 TiWorker.exe Token: SeSecurityPrivilege 1836 TiWorker.exe Token: SeBackupPrivilege 1836 TiWorker.exe Token: SeRestorePrivilege 1836 TiWorker.exe Token: SeSecurityPrivilege 1836 TiWorker.exe Token: SeBackupPrivilege 1836 TiWorker.exe Token: SeRestorePrivilege 1836 TiWorker.exe Token: SeSecurityPrivilege 1836 TiWorker.exe Token: SeBackupPrivilege 1836 TiWorker.exe Token: SeRestorePrivilege 1836 TiWorker.exe Token: SeSecurityPrivilege 1836 TiWorker.exe Token: SeBackupPrivilege 1836 TiWorker.exe Token: SeRestorePrivilege 1836 TiWorker.exe Token: SeSecurityPrivilege 1836 TiWorker.exe Token: SeBackupPrivilege 1836 TiWorker.exe Token: SeRestorePrivilege 1836 TiWorker.exe Token: SeSecurityPrivilege 1836 TiWorker.exe Token: SeBackupPrivilege 1836 TiWorker.exe Token: SeRestorePrivilege 1836 TiWorker.exe Token: SeSecurityPrivilege 1836 TiWorker.exe Token: SeBackupPrivilege 1836 TiWorker.exe Token: SeRestorePrivilege 1836 TiWorker.exe Token: SeSecurityPrivilege 1836 TiWorker.exe Token: SeBackupPrivilege 1836 TiWorker.exe Token: SeRestorePrivilege 1836 TiWorker.exe Token: SeSecurityPrivilege 1836 TiWorker.exe Token: SeBackupPrivilege 1836 TiWorker.exe Token: SeRestorePrivilege 1836 TiWorker.exe Token: SeSecurityPrivilege 1836 TiWorker.exe Token: SeBackupPrivilege 1836 TiWorker.exe Token: SeRestorePrivilege 1836 TiWorker.exe Token: SeSecurityPrivilege 1836 TiWorker.exe Token: SeBackupPrivilege 1836 TiWorker.exe Token: SeRestorePrivilege 1836 TiWorker.exe Token: SeSecurityPrivilege 1836 TiWorker.exe Token: SeBackupPrivilege 1836 TiWorker.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1740 EXCEL.EXE 1740 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 1740 EXCEL.EXE 1740 EXCEL.EXE 1740 EXCEL.EXE 1740 EXCEL.EXE 1740 EXCEL.EXE 1740 EXCEL.EXE 1740 EXCEL.EXE 1740 EXCEL.EXE 1740 EXCEL.EXE 1740 EXCEL.EXE 1740 EXCEL.EXE 1740 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\TW0091.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1740
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3448
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1836