Analysis
- max time kernel
174s - max time network
195s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
19/02/2022, 07:19
Static task
static1
Behavioral task
behavioral1
Sample
itsrainingmen.xls
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
itsrainingmen.xls
Resource
win10v2004-en-20220112
windows10-2004_x64
0 signatures
0 seconds
General
- Target itsrainingmen.xls
- Size 36KB
- Sample220219-h5jffahce2
- SHA256 48ea8d8723a8ba151a6d6f6bc1b43ab25f018fea7a03acc00aec77a19b844038
- MD5 7e5c7c22612a274de6e5a671d59338c5
- SHA1 bd0d147cadad8e36ffb5581477e733f7a44014d5
- SHA512 11560ea36c5573ba77edf548fcc58b2ce345818c3cd0f2af56c804acac9502bb3dead18d8f9d410940ff22a4e1a4809587cec81f96aaa3218d01db588fde9fad
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 4028 3820 explorer.exe 55 - Blocklisted process makes network request 1 IoCs
flow pid Process 94 1004 WScript.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe - Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotifyIcon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotifyIcon.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE - Modifies data under HKEY_USERS 50 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132899052742483205" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "7.499290" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "3.124974" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4304" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4120" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4308" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "12.496181" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config svchost.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings explorer.exe - Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 94 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3820 EXCEL.EXE - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeSecurityPrivilege 2740 TiWorker.exe Token: SeRestorePrivilege 2740 TiWorker.exe Token: SeBackupPrivilege 2740 TiWorker.exe Token: SeBackupPrivilege 2740 TiWorker.exe Token: SeRestorePrivilege 2740 TiWorker.exe Token: SeSecurityPrivilege 2740 TiWorker.exe Token: SeBackupPrivilege 2740 TiWorker.exe Token: SeRestorePrivilege 2740 TiWorker.exe Token: SeSecurityPrivilege 2740 TiWorker.exe Token: SeBackupPrivilege 2740 TiWorker.exe Token: SeRestorePrivilege 2740 TiWorker.exe Token: SeSecurityPrivilege 2740 TiWorker.exe Token: SeBackupPrivilege 2740 TiWorker.exe Token: SeRestorePrivilege 2740 TiWorker.exe Token: SeSecurityPrivilege 2740 TiWorker.exe Token: SeBackupPrivilege 2740 TiWorker.exe Token: SeRestorePrivilege 2740 TiWorker.exe Token: SeSecurityPrivilege 2740 TiWorker.exe Token: SeBackupPrivilege 2740 TiWorker.exe Token: SeRestorePrivilege 2740 TiWorker.exe Token: SeSecurityPrivilege 2740 TiWorker.exe Token: SeBackupPrivilege 2740 TiWorker.exe Token: SeRestorePrivilege 2740 TiWorker.exe Token: SeSecurityPrivilege 2740 TiWorker.exe Token: SeBackupPrivilege 2740 TiWorker.exe Token: SeRestorePrivilege 2740 TiWorker.exe Token: SeSecurityPrivilege 2740 TiWorker.exe Token: SeBackupPrivilege 2740 TiWorker.exe Token: SeRestorePrivilege 2740 TiWorker.exe Token: SeSecurityPrivilege 2740 TiWorker.exe Token: SeBackupPrivilege 2740 TiWorker.exe Token: SeRestorePrivilege 2740 TiWorker.exe Token: SeSecurityPrivilege 2740 TiWorker.exe Token: SeBackupPrivilege 2740 TiWorker.exe Token: SeRestorePrivilege 2740 TiWorker.exe Token: SeSecurityPrivilege 2740 TiWorker.exe Token: SeBackupPrivilege 2740 TiWorker.exe Token: SeRestorePrivilege 2740 TiWorker.exe Token: SeSecurityPrivilege 2740 TiWorker.exe Token: SeBackupPrivilege 2740 TiWorker.exe Token: SeRestorePrivilege 2740 TiWorker.exe Token: SeSecurityPrivilege 2740 TiWorker.exe Token: SeBackupPrivilege 2740 TiWorker.exe Token: SeRestorePrivilege 2740 TiWorker.exe Token: SeSecurityPrivilege 2740 TiWorker.exe Token: SeBackupPrivilege 2740 TiWorker.exe Token: SeRestorePrivilege 2740 TiWorker.exe Token: SeSecurityPrivilege 2740 TiWorker.exe Token: SeBackupPrivilege 2740 TiWorker.exe Token: SeRestorePrivilege 2740 TiWorker.exe Token: SeSecurityPrivilege 2740 TiWorker.exe Token: SeBackupPrivilege 2740 TiWorker.exe Token: SeRestorePrivilege 2740 TiWorker.exe Token: SeSecurityPrivilege 2740 TiWorker.exe Token: SeBackupPrivilege 2740 TiWorker.exe Token: SeRestorePrivilege 2740 TiWorker.exe Token: SeSecurityPrivilege 2740 TiWorker.exe Token: SeBackupPrivilege 2740 TiWorker.exe Token: SeRestorePrivilege 2740 TiWorker.exe Token: SeSecurityPrivilege 2740 TiWorker.exe Token: SeBackupPrivilege 2740 TiWorker.exe Token: SeRestorePrivilege 2740 TiWorker.exe Token: SeSecurityPrivilege 2740 TiWorker.exe Token: SeBackupPrivilege 2740 TiWorker.exe - Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 3820 EXCEL.EXE 3820 EXCEL.EXE 3820 EXCEL.EXE 3820 EXCEL.EXE 3820 EXCEL.EXE 3820 EXCEL.EXE 3820 EXCEL.EXE 3820 EXCEL.EXE 3820 EXCEL.EXE 3820 EXCEL.EXE 3820 EXCEL.EXE 3820 EXCEL.EXE 3820 EXCEL.EXE 3820 EXCEL.EXE - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3820 wrote to memory of 4028 3820 EXCEL.EXE 80 PID 3820 wrote to memory of 4028 3820 EXCEL.EXE 80 PID 3948 wrote to memory of 1004 3948 explorer.exe 82 PID 3948 wrote to memory of 1004 3948 explorer.exe 82
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\itsrainingmen.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Windows\explorer.exeexplorer.exe C:\Users\Public\Documents\hmAEEQYG.vbs2⤵
- Process spawned unexpected child process
PID:4028
-
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
PID:3136
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1520
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2740
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\hmAEEQYG.vbs"2⤵
- Blocklisted process makes network request
PID:1004
-