Analysis

  • max time kernel
    119s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    27-10-2024 10:57

General

  • Target

    e5cae5d1795bfc9b308b92f20b2421aecc81b97d36624863871bae5739aab3de.xlsm

  • Size

    201KB

  • MD5

    c595d96742a883a534ed1ca1f0d279d1

  • SHA1

    c465daa9e5bd998ef39c59f80f82f79cc75ce659

  • SHA256

    e5cae5d1795bfc9b308b92f20b2421aecc81b97d36624863871bae5739aab3de

  • SHA512

    142506545388000aad69fbd9dabd62cb80b75fceb83cb8e31747a1c2de5495327fff2d4a6badabc691fb68df2361aa9f0a5adf969cf3f688b1f89959ca04538b

  • SSDEEP

    6144:+pQEXBxlv/9mIRzcZcD50SQBpDb8FJA7xqSWbLsE4D:+XBrv/AIRA6D5nQB5b8FJA7xGfsVD

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 9 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

    Payload decoded via CertUtil.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

  • Office loads VBA resources, possible macro or embedded object present
  • Delays execution with timeout.exe 1 IoCs
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 50 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\e5cae5d1795bfc9b308b92f20b2421aecc81b97d36624863871bae5739aab3de.xlsm
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1724
    • C:\Windows\SysWOW64\certutil.exe
      "C:\Windows\System32\certutil.exe" -decode C:\Users\Admin\AppData\Local\Temp\Z74435e84d5ae7c60f81018b4950fef2fc7 C:\Users\Admin\AppData\Local\Temp\Of74e1e35dd903c3c23095278b7f18453a5.exe
      2⤵
      • Process spawned unexpected child process
      • Deobfuscate/Decode Files or Information
      • System Location Discovery: System Language Discovery
      PID:2488
    • C:\Users\Admin\AppData\Local\Temp\Of74e1e35dd903c3c23095278b7f18453a5.exe
      "C:\Users\Admin\AppData\Local\Temp\Of74e1e35dd903c3c23095278b7f18453a5.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:616
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C chcp 65001 && timeout /t 3 > NUL && schtasks /create /tn "Of74e1e35dd903c3c23095278b7f18453a5" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\Starlabs\Of74e1e35dd903c3c23095278b7f18453a5.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\Of74e1e35dd903c3c23095278b7f18453a5.exe" &&START "" "C:\Users\Admin\AppData\Local\Starlabs\Of74e1e35dd903c3c23095278b7f18453a5.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1096
        • C:\Windows\system32\chcp.com
          chcp 65001
          4⤵
            PID:2836
          • C:\Windows\system32\timeout.exe
            timeout /t 3
            4⤵
            • Delays execution with timeout.exe
            PID:2876
          • C:\Windows\system32\schtasks.exe
            schtasks /create /tn "Of74e1e35dd903c3c23095278b7f18453a5" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\Starlabs\Of74e1e35dd903c3c23095278b7f18453a5.exe" /rl HIGHEST /f
            4⤵
            • Scheduled Task/Job: Scheduled Task
            PID:2912
          • C:\Users\Admin\AppData\Local\Starlabs\Of74e1e35dd903c3c23095278b7f18453a5.exe
            "C:\Users\Admin\AppData\Local\Starlabs\Of74e1e35dd903c3c23095278b7f18453a5.exe"
            4⤵
            • Executes dropped EXE
            • Accesses Microsoft Outlook profiles
            • Modifies system certificate store
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • outlook_office_path
            • outlook_win_path
            PID:2652
            • C:\Windows\system32\cmd.exe
              "cmd.exe" /c chcp 65001 && netsh wlan show profiles|findstr /R /C:"[ ]:[ ]"
              5⤵
              • System Network Configuration Discovery: Wi-Fi Discovery
              • Suspicious use of WriteProcessMemory
              PID:2740
              • C:\Windows\system32\chcp.com
                chcp 65001
                6⤵
                  PID:2436
                • C:\Windows\system32\netsh.exe
                  netsh wlan show profiles
                  6⤵
                  • Event Triggered Execution: Netsh Helper DLL
                  • System Network Configuration Discovery: Wi-Fi Discovery
                  PID:2212
                • C:\Windows\system32\findstr.exe
                  findstr /R /C:"[ ]:[ ]"
                  6⤵
                    PID:2332
                • C:\Windows\system32\cmd.exe
                  "cmd.exe" /c chcp 65001 && netsh wlan show networks mode=bssid | findstr "SSID BSSID Signal"
                  5⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1404
                  • C:\Windows\system32\chcp.com
                    chcp 65001
                    6⤵
                      PID:1768
                    • C:\Windows\system32\netsh.exe
                      netsh wlan show networks mode=bssid
                      6⤵
                      • Event Triggered Execution: Netsh Helper DLL
                      PID:1340
                    • C:\Windows\system32\findstr.exe
                      findstr "SSID BSSID Signal"
                      6⤵
                        PID:1648
            • C:\Windows\system32\taskeng.exe
              taskeng.exe {B69DEFEE-9A05-4BBB-A78C-DF4A780B699B} S-1-5-21-4177215427-74451935-3209572229-1000:JSMURNPT\Admin:Interactive:[1]
              1⤵
              • Suspicious use of WriteProcessMemory
              PID:2832
              • C:\Users\Admin\AppData\Local\Starlabs\Of74e1e35dd903c3c23095278b7f18453a5.exe
                C:\Users\Admin\AppData\Local\Starlabs\Of74e1e35dd903c3c23095278b7f18453a5.exe
                2⤵
                • Executes dropped EXE
                • Modifies system certificate store
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of SetWindowsHookEx
                PID:2912

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

              Filesize

              342B

              MD5

              a10ca478941ac4a26b8c720dd87ad512

              SHA1

              6a77bb857e499df653417b2a22c88451fac8fba8

              SHA256

              163545cb6113804c623c068240fcd45df38997970680cc0efa0e90d68f8b63ed

              SHA512

              91de21c74e09394335e8af00a8f421d84ad3bbbaacfe9d1e618ffb808e5016dee60b7f887f02d718a609ffed16de7a2ca2af976ae7b3448b7f062eb485156d95

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

              Filesize

              342B

              MD5

              90304c896a0d8a2ca5cf0a83f989a396

              SHA1

              679be55a45f2e089740f3218d6938d2decc6149e

              SHA256

              863a087c6a857e260548edb0856f2225e1f0ea7892cf642f3f75fda3f5872e3b

              SHA512

              22edac5230ee5d05eb0fec7215bf1367ef33c72910e3d4325866f2429c674a58218e5aaf526d1d15a3e8fba80fe3d3db47d37424b676b38cc33d73b5c78cc4c3

            • C:\Users\Admin\AppData\Local\Temp\CabD664.tmp

              Filesize

              70KB

              MD5

              49aebf8cbd62d92ac215b2923fb1b9f5

              SHA1

              1723be06719828dda65ad804298d0431f6aff976

              SHA256

              b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

              SHA512

              bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

            • C:\Users\Admin\AppData\Local\Temp\Of74e1e35dd903c3c23095278b7f18453a5.exe

              Filesize

              135KB

              MD5

              410bd9796a48df659618b405cdcedced

              SHA1

              b87887753569673a6a3ea8ad568e0174c214f1ff

              SHA256

              9c5701ef66f03629131a476381865069d0cf78bed20fab2725d04c2f9471af5f

              SHA512

              1441142e9ade59fcea06afa43033ead028c68f0b5d420ded9fbd4b2c6fdcdd16bb002a58a87a4d637c7df70e1a5d680367be2bd8cc24e6e7346247d3587c9f5e

            • C:\Users\Admin\AppData\Local\Temp\TarD686.tmp

              Filesize

              181KB

              MD5

              4ea6026cf93ec6338144661bf1202cd1

              SHA1

              a1dec9044f750ad887935a01430bf49322fbdcb7

              SHA256

              8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

              SHA512

              6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

            • C:\Users\Admin\AppData\Local\Temp\Z74435e84d5ae7c60f81018b4950fef2fc7

              Filesize

              180KB

              MD5

              b2d32fe2797534b941688bc919d564fd

              SHA1

              7949b2d8e9e1d5c1e84618e10d61b615e0376676

              SHA256

              5331e34ca1acf5576ce551607ecf5bf4430078e08a02bd940bab501bcb62135c

              SHA512

              13b598897c35adfa09cf4664a20cf38bbde4968c2961691bff9e772c8ec6c5e97b241525fb39bffbeb02fa9bcde132897e3be3372c428d80529c89827bb70596

            • C:\Users\Admin\AppData\Local\csxe3bn6se\p.dat

              Filesize

              4B

              MD5

              3b3fff6463464959dcd1b68d0320f781

              SHA1

              8351a2027976ef549f0fc2416068f1b883b3824e

              SHA256

              b567edd38e178dac20d4252c7e42ffedd866d91f315ffaa00d6dd682c1586f17

              SHA512

              028d9d01ba9b2e2f454c7d3c11ca4601c5eb290725510c05d1b4d670c0fdd97a9dce677cadc0a1f78c9722c638c1b58457e07a4dcca12271ffde3333a44a63b4

            • memory/616-11-0x0000000000360000-0x0000000000388000-memory.dmp

              Filesize

              160KB

            • memory/1724-115-0x00000000724AD000-0x00000000724B8000-memory.dmp

              Filesize

              44KB

            • memory/1724-5-0x0000000006680000-0x0000000006780000-memory.dmp

              Filesize

              1024KB

            • memory/1724-2-0x0000000006680000-0x0000000006780000-memory.dmp

              Filesize

              1024KB

            • memory/1724-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

              Filesize

              64KB

            • memory/1724-116-0x0000000006680000-0x0000000006780000-memory.dmp

              Filesize

              1024KB

            • memory/1724-3-0x0000000006680000-0x0000000006780000-memory.dmp

              Filesize

              1024KB

            • memory/1724-1-0x00000000724AD000-0x00000000724B8000-memory.dmp

              Filesize

              44KB

            • memory/2652-17-0x00000000009E0000-0x0000000000A08000-memory.dmp

              Filesize

              160KB