77230b54c465750579d7ceae5bb91dd37b232c03be340b7fb0ffd0ad4f5ea1c9

General

Target

2044.20200.xlsx
Size

327KB
MD5

6fe9f85abfe8ef2ded7ab31c4faa454a
SHA1

7e3b43d0df03c59b1941174646398ef456f1e1ed
SHA256

77230b54c465750579d7ceae5bb91dd37b232c03be340b7fb0ffd0ad4f5ea1c9
SHA512

9f95e913c505b627301dad1f20802e205c97da1a4fe31258ec397e23d6d44a869daba8584860c26d88e4a0323e8c60f865a2c2147779c76c49b8d702bf1b357a

Score

8^/10

Blacklisted process makes network request 3 IoCs

Processes:

EQNEDT32.EXE

flow pid process

2 1984 EQNEDT32.EXE
3 1984 EQNEDT32.EXE
4 1984 EQNEDT32.EXE
Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

EXCEL.EXE

description ioc process

Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
exploit

Exploitation for Client Execution
T1203

Processes:

EQNEDT32.EXE

pid process

1984 EQNEDT32.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

pid	process
1984	EQNEDT32.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

Modify Registry

Processes:

EXCEL.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1096 EXCEL.EXE
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

EXCEL.EXE

pid process

1096 EXCEL.EXE
1096 EXCEL.EXE
1096 EXCEL.EXE

pid	process
1096	EXCEL.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

EQNEDT32.EXE

description	pid	process	target process
PID 1984 wrote to memory of 1632	1984	EQNEDT32.EXE	cmd.exe
PID 1984 wrote to memory of 1632	1984	EQNEDT32.EXE	cmd.exe
PID 1984 wrote to memory of 1632	1984	EQNEDT32.EXE	cmd.exe
PID 1984 wrote to memory of 1632	1984	EQNEDT32.EXE	cmd.exe