Malware Analysis Report

2025-03-15 07:58

Sample ID 240815-z41f1avdna
Target 4adf965b85323cb1ff9224ffdd076d53db4da02987dc29269525d630245dc12a
SHA256 4adf965b85323cb1ff9224ffdd076d53db4da02987dc29269525d630245dc12a
Tags
bootkit discovery persistence macro macro_on_action
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

4adf965b85323cb1ff9224ffdd076d53db4da02987dc29269525d630245dc12a

Threat Level: Likely malicious

The file 4adf965b85323cb1ff9224ffdd076d53db4da02987dc29269525d630245dc12a was found to be: Likely malicious.

Malicious Activity Summary

bootkit discovery persistence macro macro_on_action

Suspicious Office macro

Office macro that triggers on suspicious action

Executes dropped EXE

Loads dropped DLL

Writes to the Master Boot Record (MBR)

System Location Discovery: System Language Discovery

Office loads VBA resources, possible macro or embedded object present

Suspicious behavior: AddClipboardFormatListener

Checks processor information in registry

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Enumerates system info in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-15 21:17

Signatures

Office macro that triggers on suspicious action

macro macro_on_action
Description Indicator Process Target
N/A N/A N/A N/A

Suspicious Office macro

macro
Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-15 21:17

Reported

2024-08-15 21:18

Platform

win7-20240708-en

Max time kernel

9s

Max time network

0s

Command Line

"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\4adf965b85323cb1ff9224ffdd076d53db4da02987dc29269525d630245dc12a.xls

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rad901C0.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Roaming\{15705dbe-a36c-44fc-ab26-062f0c296290}\netbtugc.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\rad901C0.exe N/A

Office loads VBA resources, possible macro or embedded object present

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\{15705dbe-a36c-44fc-ab26-062f0c296290}\netbtugc.exe N/A

Processes

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\4adf965b85323cb1ff9224ffdd076d53db4da02987dc29269525d630245dc12a.xls

C:\Users\Admin\AppData\Local\Temp\rad901C0.exe

"C:\Users\Admin\AppData\Local\Temp\rad901C0.exe"

C:\Users\Admin\AppData\Roaming\{15705dbe-a36c-44fc-ab26-062f0c296290}\netbtugc.exe

"C:\Users\Admin\AppData\Roaming\{15705dbe-a36c-44fc-ab26-062f0c296290}\netbtugc.exe"

Network

N/A

Files

memory/2508-1-0x0000000072A4D000-0x0000000072A58000-memory.dmp

memory/2508-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/2508-30-0x0000000000350000-0x0000000000450000-memory.dmp

memory/2508-35-0x0000000000350000-0x0000000000450000-memory.dmp

memory/2508-77-0x0000000000350000-0x0000000000450000-memory.dmp

memory/2508-31-0x0000000000350000-0x0000000000450000-memory.dmp

memory/2508-32-0x0000000000350000-0x0000000000450000-memory.dmp

memory/2508-33-0x0000000000350000-0x0000000000450000-memory.dmp

memory/2508-146-0x00000000066E0000-0x00000000067E0000-memory.dmp

memory/2508-129-0x0000000000350000-0x0000000000450000-memory.dmp

memory/2508-79-0x0000000000350000-0x0000000000450000-memory.dmp

memory/2508-78-0x0000000000350000-0x0000000000450000-memory.dmp

memory/2508-76-0x0000000000350000-0x0000000000450000-memory.dmp

memory/2508-75-0x0000000000350000-0x0000000000450000-memory.dmp

memory/2508-74-0x0000000000350000-0x0000000000450000-memory.dmp

memory/2508-73-0x0000000000350000-0x0000000000450000-memory.dmp

memory/2508-72-0x0000000000350000-0x0000000000450000-memory.dmp

memory/2508-71-0x0000000000350000-0x0000000000450000-memory.dmp

memory/2508-70-0x0000000000350000-0x0000000000450000-memory.dmp

memory/2508-69-0x0000000000350000-0x0000000000450000-memory.dmp

memory/2508-41-0x00000000066E0000-0x00000000067E0000-memory.dmp

memory/2508-40-0x0000000000350000-0x0000000000450000-memory.dmp

memory/2508-39-0x0000000000350000-0x0000000000450000-memory.dmp

memory/2508-38-0x0000000000350000-0x0000000000450000-memory.dmp

memory/2508-37-0x0000000000350000-0x0000000000450000-memory.dmp

memory/2508-36-0x0000000000350000-0x0000000000450000-memory.dmp

memory/2508-34-0x0000000000350000-0x0000000000450000-memory.dmp

\Users\Admin\AppData\Local\Temp\rad901C0.exe

MD5 e3b7d39be5e821b59636d0fe7c2944cc
SHA1 00479a97e415e9b6a5dfb5d04f5d9244bc8fbe88
SHA256 389a7d395492c2da6f8abf5a8a7c49c3482f7844f77fe681808c71e961bcae97
SHA512 8f977c60658063051968049245512b6aea68dd89005d0eefde26e4b2757210e9e95aabcef9aee173f57614b52cfbac924d36516b7bc7d3a5cc67daae4dee3ad5

C:\Users\Admin\AppData\Roaming\{15705dbe-a36c-44fc-ab26-062f0c296290}\netbtugc.exe

MD5 bdb501a004fea9db913551b41a3ea485
SHA1 e3a7074a6986ed85789957627b7f794dff727732
SHA256 5b7a23853a0f2617e0b8039816bf4040845554c16b8ad15f25202a3cf56f7211
SHA512 4ad2ff5fed113d4637498d6c164529b644a7d4080fba7e5e8c22279305e5f207e0347baff2282687e67bac30e1c8bf50d7c461e302462c231935915a9b145353

memory/2508-1581-0x0000000072A4D000-0x0000000072A58000-memory.dmp

memory/2508-1583-0x00000000066E0000-0x00000000067E0000-memory.dmp

memory/2508-1582-0x0000000000350000-0x0000000000450000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-15 21:17

Reported

2024-08-15 21:18

Platform

win10v2004-20240802-en

Max time kernel

38s

Max time network

38s

Command Line

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\4adf965b85323cb1ff9224ffdd076d53db4da02987dc29269525d630245dc12a.xls"

Signatures

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Processes

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\4adf965b85323cb1ff9224ffdd076d53db4da02987dc29269525d630245dc12a.xls"

Network

Country Destination Domain Proto
US 8.8.8.8:53 roaming.officeapps.live.com udp
GB 52.109.28.47:443 roaming.officeapps.live.com tcp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 47.28.109.52.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 85.242.123.52.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 16.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 147.142.123.92.in-addr.arpa udp

Files

memory/4948-0-0x00007FF7DA890000-0x00007FF7DA8A0000-memory.dmp

memory/4948-1-0x00007FF81A8AD000-0x00007FF81A8AE000-memory.dmp

memory/4948-3-0x00007FF7DA890000-0x00007FF7DA8A0000-memory.dmp

memory/4948-2-0x00007FF7DA890000-0x00007FF7DA8A0000-memory.dmp

memory/4948-4-0x00007FF81A810000-0x00007FF81AA05000-memory.dmp

memory/4948-7-0x00007FF81A810000-0x00007FF81AA05000-memory.dmp

memory/4948-9-0x00007FF81A810000-0x00007FF81AA05000-memory.dmp

memory/4948-11-0x00007FF81A810000-0x00007FF81AA05000-memory.dmp

memory/4948-12-0x00007FF7D83F0000-0x00007FF7D8400000-memory.dmp

memory/4948-10-0x00007FF81A810000-0x00007FF81AA05000-memory.dmp

memory/4948-8-0x00007FF7DA890000-0x00007FF7DA8A0000-memory.dmp

memory/4948-13-0x00007FF81A810000-0x00007FF81AA05000-memory.dmp

memory/4948-16-0x00007FF81A810000-0x00007FF81AA05000-memory.dmp

memory/4948-15-0x00007FF81A810000-0x00007FF81AA05000-memory.dmp

memory/4948-14-0x00007FF7D83F0000-0x00007FF7D8400000-memory.dmp

memory/4948-6-0x00007FF81A810000-0x00007FF81AA05000-memory.dmp

memory/4948-5-0x00007FF7DA890000-0x00007FF7DA8A0000-memory.dmp

memory/4948-17-0x00007FF81A810000-0x00007FF81AA05000-memory.dmp

memory/4948-20-0x00007FF81A810000-0x00007FF81AA05000-memory.dmp

memory/4948-21-0x00007FF81A810000-0x00007FF81AA05000-memory.dmp

memory/4948-19-0x00007FF81A810000-0x00007FF81AA05000-memory.dmp

memory/4948-18-0x00007FF81A810000-0x00007FF81AA05000-memory.dmp

memory/4948-1634-0x00007FF81A810000-0x00007FF81AA05000-memory.dmp

memory/4948-1635-0x00007FF81A8AD000-0x00007FF81A8AE000-memory.dmp