535f2b04a4086696d3fafb347cba4a40d6647a3c9c0b8b4690e966d789b5f45e

General

Target

MV SPYRO AFEA VOY 156 PARTICULARS.xlsm
Size

51KB
MD5

63e87619e5dcb07ca54ef9d82d99f7c0
SHA1

7fd77e39fbf7ad6e8ade3e6592580a81a7373c54
SHA256

535f2b04a4086696d3fafb347cba4a40d6647a3c9c0b8b4690e966d789b5f45e
SHA512

f7ba6d6d7b45b3f335bdb787c2393f0fc22aea8b01317643b3b3d006801c4cfc1a40301aa71cee87a57b460ba70c12be603369b042081dcfb1539466c904e8d1

Score

10^/10

Malware Config

Signatures

Script User-Agent 1 IoCs

Processes:

description flow ioc

HTTP User-Agent header 14 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

description	flow	ioc
HTTP User-Agent header	14	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

3988 EXCEL.EXE

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cscript.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	2052	3988	cscript.exe	EXCEL.EXE

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

EXCEL.EXEcscript.exe

description	pid	process	target process
PID 3988 wrote to memory of 2052	3988	EXCEL.EXE	cscript.exe
PID 3988 wrote to memory of 2052	3988	EXCEL.EXE	cscript.exe
PID 2052 wrote to memory of 4016	2052	cscript.exe	5znX0kpa.exe
PID 2052 wrote to memory of 4016	2052	cscript.exe	5znX0kpa.exe
PID 2052 wrote to memory of 4016	2052	cscript.exe	5znX0kpa.exe

Executes dropped EXE 1 IoCs

Processes:

5znX0kpa.exe

pid process

4016 5znX0kpa.exe

pid	process
4016	5znX0kpa.exe

NTFS ADS 3 IoCs

Processes:

EXCEL.EXE

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\mm:Zone.Identifier	EXCEL.EXE
File opened for modification	C:\Users\Admin\AppData\Local\Temp\xx:Zone.Identifier	EXCEL.EXE
File created	C:\programdata\asc.txt:script1.vbs	EXCEL.EXE

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

EXCEL.EXE

pid	process
3988	EXCEL.EXE
3988	EXCEL.EXE
3988	EXCEL.EXE
3988	EXCEL.EXE
3988	EXCEL.EXE
3988	EXCEL.EXE
3988	EXCEL.EXE
3988	EXCEL.EXE
3988	EXCEL.EXE
3988	EXCEL.EXE
3988	EXCEL.EXE
3988	EXCEL.EXE

Blacklisted process makes network request 1 IoCs

Processes:

cscript.exe

flow pid process

14 2052 cscript.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3680 4016 WerFault.exe 5znX0kpa.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3680 WerFault.exe
Token: SeBackupPrivilege 3680 WerFault.exe
Token: SeDebugPrivilege 3680 WerFault.exe

flow	pid	process
14	2052	cscript.exe

pid	pid_target	process	target process
3680	4016	WerFault.exe	5znX0kpa.exe

description	pid	process
Token: SeRestorePrivilege	3680	WerFault.exe
Token: SeBackupPrivilege	3680	WerFault.exe
Token: SeDebugPrivilege	3680	WerFault.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
3680	WerFault.exe
3680	WerFault.exe
3680	WerFault.exe
3680	WerFault.exe
3680	WerFault.exe
3680	WerFault.exe
3680	WerFault.exe
3680	WerFault.exe
3680	WerFault.exe
3680	WerFault.exe
3680	WerFault.exe
3680	WerFault.exe
3680	WerFault.exe
3680	WerFault.exe

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\MV SPYRO AFEA VOY 156 PARTICULARS.xlsm"
1⤵
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
- NTFS ADS
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:3988

C:\Windows\System32\cscript.exe
"C:\Windows\System32\cscript.exe" C:\programdata\asc.txt:script1.vbs
2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
- Blacklisted process makes network request
PID:2052

C:\programdata\5znX0kpa.exe
C:\programdata\5znX0kpa.exe
3⤵
- Executes dropped EXE
PID:4016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 924
4⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:3680

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\5znX0kpa.exe

Download Submit
C:\programdata\5znX0kpa.exe

Download Submit
C:\programdata\asc.txt:script1.vbs

Download Submit
memory/2052-3-0x0000000000000000-mapping.dmp

Download
memory/3680-20-0x0000000004D40000-0x0000000004D41000-memory.dmp

Filesize
4KB

Download
memory/3680-8-0x0000000004680000-0x0000000004681000-memory.dmp

Filesize
4KB

Download
memory/3680-9-0x0000000004680000-0x0000000004681000-memory.dmp

Filesize
4KB

Download
memory/3680-19-0x0000000004940000-0x0000000004941000-memory.dmp

Filesize
4KB

Download
memory/4016-12-0x0000000000000000-mapping.dmp

Download
memory/4016-13-0x0000000000000000-mapping.dmp

Download
memory/4016-14-0x0000000000000000-mapping.dmp

Download
memory/4016-15-0x0000000000000000-mapping.dmp

Download
memory/4016-16-0x0000000000000000-mapping.dmp

Download
memory/4016-17-0x0000000000000000-mapping.dmp

Download
memory/4016-18-0x0000000000000000-mapping.dmp

Download
memory/4016-11-0x0000000000000000-mapping.dmp

Download
memory/4016-5-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads