3ad4819cec95571fba65855ebde66a308472c22a4c06501bfa1b1d51730572cc

General

Target

faktura_18.xlsm
Size

95KB
MD5

69f269d0a5e726c0bcafa1e81a456f79
SHA1

a6537a821e059c4d10f9c35f0135e3af0227c9e9
SHA256

3ad4819cec95571fba65855ebde66a308472c22a4c06501bfa1b1d51730572cc
SHA512

72a229fa07b9d71cca6b120f7f2cf57b23c535d4bafe4b5bb65e9e0202e822ebfd7a54405e8b60c0514728f3c7815513049a049e1bde7ed02637e3c5e44dd1c9

Score

10^/10

Language

xlm4.0

Source

URLs

xlm40.dropper

https://oidblueprin.at/3/str.dll

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

rundll32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1628	1072	rundll32.exe	EXCEL.EXE

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

System Information Discovery

Processes:

EXCEL.EXE

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

EXCEL.EXE

description ioc process

Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

Modify Registry

Processes:

EXCEL.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1072 EXCEL.EXE
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

EXCEL.EXE

pid process

1072 EXCEL.EXE
1072 EXCEL.EXE
1072 EXCEL.EXE

pid	process
1072	EXCEL.EXE

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

EXCEL.EXE

description	pid	process	target process
PID 1072 wrote to memory of 1628	1072	EXCEL.EXE	rundll32.exe
PID 1072 wrote to memory of 1628	1072	EXCEL.EXE	rundll32.exe
PID 1072 wrote to memory of 1628	1072	EXCEL.EXE	rundll32.exe
PID 1072 wrote to memory of 1628	1072	EXCEL.EXE	rundll32.exe
PID 1072 wrote to memory of 1628	1072	EXCEL.EXE	rundll32.exe
PID 1072 wrote to memory of 1628	1072	EXCEL.EXE	rundll32.exe
PID 1072 wrote to memory of 1628	1072	EXCEL.EXE	rundll32.exe

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\faktura_18.xlsm
1⤵
- Enumerates connected drives
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\HFKhnuZ\mlCGIzZ\uOUcRwG.dll,DllRegisterServer
  2⤵
  - Process spawned unexpected child process
  PID:1628