d6063921e36b12414d769eda7cf5715541d149e54168128ceeb800a05f9f2b3d

Resubmissions

11/12/2020, 14:10

201211-syk341hhhe10

11/12/2020, 14:04

201211-7b5pp39k3x8

Analysis

max time kernel
73s
max time network
69s
platform
windows7_x64
resource
win7v20201028
submitted
11/12/2020, 14:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Order-3899.xls
Size 32KB
Sample201211-syk341hhhe
SHA256 d6063921e36b12414d769eda7cf5715541d149e54168128ceeb800a05f9f2b3d
MD5 5c78e4a9ca8178621432bec41dfe82ce
SHA1 bc2d2d2c559395f29835876a196b96b7f5763561
SHA512 573140835de86f47308986757608be778d8cab4e10ca2d1b0c6d1e1837eff30acce84c204b9f65ed462506bb101f295709ec57a588a515b2f8b9db76e57f8070
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1108	1408	rundll32.exe	24

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1408	EXCEL.EXE

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
1408	EXCEL.EXE
1408	EXCEL.EXE
1408	EXCEL.EXE
1408	EXCEL.EXE
1408	EXCEL.EXE
1408	EXCEL.EXE
1408	EXCEL.EXE
1408	EXCEL.EXE
1408	EXCEL.EXE
1408	EXCEL.EXE

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 1108	1408	EXCEL.EXE	32
PID 1408 wrote to memory of 1108	1408	EXCEL.EXE	32
PID 1408 wrote to memory of 1108	1408	EXCEL.EXE	32
PID 1408 wrote to memory of 1108	1408	EXCEL.EXE	32
PID 1408 wrote to memory of 1108	1408	EXCEL.EXE	32
PID 1408 wrote to memory of 1108	1408	EXCEL.EXE	32
PID 1408 wrote to memory of 1108	1408	EXCEL.EXE	32

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\Order-3899.xls
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Users\Public\Documents\RqbAANF.txt,DllRegisterServer
  2⤵
  - Process spawned unexpected child process
  PID:1108

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1408-4-0x00000000045B0000-0x00000000045B8000-memory.dmp

Download

memory/1544-2-0x000007FEF6680000-0x000007FEF68FA000-memory.dmp