Analysis
-
max time kernel
137s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
29-03-2022 23:26
Static task
static1
Behavioral task
behavioral1
Sample
6e4513d1bc45644004b84e3a4bfc027b428bea3484ceaaa7489778fa9f7a88c9.xlsm
Resource
win7-20220310-en
General
-
Target
6e4513d1bc45644004b84e3a4bfc027b428bea3484ceaaa7489778fa9f7a88c9.xlsm
-
Size
1.6MB
-
MD5
d9c0d4a7bbb8ec67b195daa158f04f5f
-
SHA1
ffcfeca98f3aeb343bba753cd3d84f1770b7665e
-
SHA256
6e4513d1bc45644004b84e3a4bfc027b428bea3484ceaaa7489778fa9f7a88c9
-
SHA512
421f6ddda2c26ba8434cde9a9c8337b8dc88c3d8be378b0f56d1f9bb8ef3e675e3f4b2a8a03f5f6df6dd2b039a0beed1791a1e8c5c35adb7c926b433d597f228
Malware Config
Signatures
-
PlugX Rat Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/60-145-0x000002A7728D0000-0x000002A773660000-memory.dmp PlugX -
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
powershell.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3312 60 powershell.exe EXCEL.EXE -
Process spawned suspicious child process 1 IoCs
This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.
Processes:
DW20.EXEdescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 4028 60 DW20.EXE EXCEL.EXE -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdwwin.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 dwwin.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz dwwin.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dwwin.exe -
Enumerates system info in registry 2 TTPs 5 IoCs
Processes:
EXCEL.EXEdwwin.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dwwin.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dwwin.exe -
Modifies registry class 2 IoCs
Processes:
EXCEL.EXEdescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 EXCEL.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff EXCEL.EXE -
NTFS ADS 1 IoCs
Processes:
EXCEL.EXEdescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Temp\{7B87D630-D489-4F7D-BD00-E59AE91CFAD6}\SPD.exe:Zone.Identifier EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 60 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
EXCEL.EXEpowershell.exepid process 60 EXCEL.EXE 3312 powershell.exe 3312 powershell.exe 60 EXCEL.EXE 60 EXCEL.EXE 60 EXCEL.EXE 60 EXCEL.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
EXCEL.EXEpowershell.exedescription pid process Token: SeDebugPrivilege 60 EXCEL.EXE Token: SeDebugPrivilege 3312 powershell.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
EXCEL.EXEpid process 60 EXCEL.EXE 60 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 15 IoCs
Processes:
EXCEL.EXEpid process 60 EXCEL.EXE 60 EXCEL.EXE 60 EXCEL.EXE 60 EXCEL.EXE 60 EXCEL.EXE 60 EXCEL.EXE 60 EXCEL.EXE 60 EXCEL.EXE 60 EXCEL.EXE 60 EXCEL.EXE 60 EXCEL.EXE 60 EXCEL.EXE 60 EXCEL.EXE 60 EXCEL.EXE 60 EXCEL.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
EXCEL.EXEDW20.EXEdescription pid process target process PID 60 wrote to memory of 2888 60 EXCEL.EXE splwow64.exe PID 60 wrote to memory of 2888 60 EXCEL.EXE splwow64.exe PID 60 wrote to memory of 3312 60 EXCEL.EXE powershell.exe PID 60 wrote to memory of 3312 60 EXCEL.EXE powershell.exe PID 60 wrote to memory of 4028 60 EXCEL.EXE DW20.EXE PID 60 wrote to memory of 4028 60 EXCEL.EXE DW20.EXE PID 4028 wrote to memory of 784 4028 DW20.EXE dwwin.exe PID 4028 wrote to memory of 784 4028 DW20.EXE dwwin.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\6e4513d1bc45644004b84e3a4bfc027b428bea3484ceaaa7489778fa9f7a88c9.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:2888
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command "& ($env:TEMP + \"\SPD.exe\") \"[email protected]\" \"Nhh2H5urwHv0\" \"https://finansco.sharepoint.com/Delte dokumenter/Finansco Gruppen Fellesmappe/Modellporteføljer/\" \"Produktark MPF Kopi.xlsx\""2⤵
- Process spawned unexpected child process
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3312 -
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE" -x -s 62922⤵
- Process spawned suspicious child process
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Windows\system32\dwwin.exeC:\Windows\system32\dwwin.exe -x -s 62923⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:784
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:2236
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/60-148-0x000002A771100000-0x000002A771122000-memory.dmpFilesize
136KB
-
memory/60-158-0x000002A7710CB000-0x000002A7710CF000-memory.dmpFilesize
16KB
-
memory/60-132-0x00007FFBE03F0000-0x00007FFBE0400000-memory.dmpFilesize
64KB
-
memory/60-133-0x00007FFBE03F0000-0x00007FFBE0400000-memory.dmpFilesize
64KB
-
memory/60-134-0x00007FFBE03F0000-0x00007FFBE0400000-memory.dmpFilesize
64KB
-
memory/60-130-0x00007FFBE03F0000-0x00007FFBE0400000-memory.dmpFilesize
64KB
-
memory/60-136-0x000002A758BD0000-0x000002A758BD4000-memory.dmpFilesize
16KB
-
memory/60-137-0x000002A771280000-0x000002A771422000-memory.dmpFilesize
1.6MB
-
memory/60-138-0x00007FFBF4250000-0x00007FFBF4D11000-memory.dmpFilesize
10.8MB
-
memory/60-139-0x000002A7710C0000-0x000002A7710C2000-memory.dmpFilesize
8KB
-
memory/60-140-0x000002A773E90000-0x000002A7768F0000-memory.dmpFilesize
42.4MB
-
memory/60-141-0x000002A7716D0000-0x000002A771964000-memory.dmpFilesize
2.6MB
-
memory/60-142-0x000002A771060000-0x000002A7710BC000-memory.dmpFilesize
368KB
-
memory/60-150-0x000002A77AC10000-0x000002A77EF26000-memory.dmpFilesize
67.1MB
-
memory/60-144-0x000002A771000000-0x000002A771022000-memory.dmpFilesize
136KB
-
memory/60-145-0x000002A7728D0000-0x000002A773660000-memory.dmpFilesize
13.6MB
-
memory/60-146-0x000002A758E30000-0x000002A758E40000-memory.dmpFilesize
64KB
-
memory/60-147-0x000002A7710F0000-0x000002A7710FA000-memory.dmpFilesize
40KB
-
memory/60-149-0x000002A7710C3000-0x000002A7710C5000-memory.dmpFilesize
8KB
-
memory/60-160-0x0000029F52CDB000-0x0000029F52CDD000-memory.dmpFilesize
8KB
-
memory/60-143-0x000002A771970000-0x000002A771B32000-memory.dmpFilesize
1.8MB
-
memory/60-151-0x000002A771130000-0x000002A771158000-memory.dmpFilesize
160KB
-
memory/60-152-0x000002A771200000-0x000002A771250000-memory.dmpFilesize
320KB
-
memory/60-153-0x000002A758EC0000-0x000002A758ED0000-memory.dmpFilesize
64KB
-
memory/60-154-0x000002A7710D0000-0x000002A7710E8000-memory.dmpFilesize
96KB
-
memory/60-155-0x000002A771430000-0x000002A77148A000-memory.dmpFilesize
360KB
-
memory/60-157-0x000002A7710C9000-0x000002A7710CB000-memory.dmpFilesize
8KB
-
memory/60-156-0x000002A7710C6000-0x000002A7710C8000-memory.dmpFilesize
8KB
-
memory/60-131-0x00007FFBE03F0000-0x00007FFBE0400000-memory.dmpFilesize
64KB
-
memory/784-169-0x0000000000000000-mapping.dmp
-
memory/2888-135-0x0000000000000000-mapping.dmp
-
memory/3312-159-0x0000000000000000-mapping.dmp
-
memory/3312-161-0x000001D8A0840000-0x000001D8A0862000-memory.dmpFilesize
136KB
-
memory/3312-162-0x00007FFBF4250000-0x00007FFBF4D11000-memory.dmpFilesize
10.8MB
-
memory/4028-163-0x0000000000000000-mapping.dmp
-
memory/4028-172-0x00007FFBE03F0000-0x00007FFBE0400000-memory.dmpFilesize
64KB
-
memory/4028-170-0x00007FFBE03F0000-0x00007FFBE0400000-memory.dmpFilesize
64KB
-
memory/4028-171-0x00007FFBE03F0000-0x00007FFBE0400000-memory.dmpFilesize
64KB
-
memory/4028-173-0x00007FFBE03F0000-0x00007FFBE0400000-memory.dmpFilesize
64KB