Resubmissions
28-02-2021 17:05
210228-pjgnbjwth2 827-02-2021 12:13
210227-bpkha5za7s 827-02-2021 04:19
210227-7c1xkzg346 1027-02-2021 03:32
210227-2xwvzgykxs 827-02-2021 03:29
210227-qgrlcph782 827-02-2021 03:16
210227-k82qfdjlve 827-02-2021 02:45
210227-mjxh7bv4wj 827-02-2021 02:23
210227-w6qfkjy5ha 827-02-2021 02:06
210227-r385kvgs32 826-02-2021 23:10
210226-yds8gthfax 8Analysis
-
max time kernel
150s -
max time network
10s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
26-02-2021 23:10
Behavioral task
behavioral1
Sample
Doc_3744.xls
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Doc_3744.xls
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
Doc_3744.xls
-
Size
62KB
-
MD5
47e22049644647ee854cedfe077156e7
-
SHA1
20ad9f47616a8272dece2ec1039a88c09412c97c
-
SHA256
5f2adacaf4ecb00ed24dd9dfe355307d0d6e786e40c945ad4c6d1ae3a4835d2a
-
SHA512
1eeb87173378f4d0e157ee42f5b28e48ff84a35b44d71f004a6180cc2bdbc09e45c071adc7ab0a94c75071fbe3ee13b939ee8cb216b6f2e06c9c24ca34dbbf1b
Score
1/10
Malware Config
Signatures
-
Office loads VBA resources, possible macro or embedded object present
-
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TypedURLs taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE -
Runs regedit.exe 1 IoCs
pid Process 624 regedit.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1932 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 3 IoCs
pid Process 624 regedit.exe 1036 taskmgr.exe 1932 EXCEL.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1036 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1932 EXCEL.EXE 1932 EXCEL.EXE 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 624 regedit.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe 1036 taskmgr.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1932 EXCEL.EXE 1932 EXCEL.EXE 1932 EXCEL.EXE 1932 EXCEL.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1036 wrote to memory of 624 1036 taskmgr.exe 31 PID 1036 wrote to memory of 624 1036 taskmgr.exe 31 PID 1036 wrote to memory of 624 1036 taskmgr.exe 31
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\Doc_3744.xls1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1932
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe"1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Windows\regedit.exe"C:\Windows\regedit.exe"2⤵
- Runs regedit.exe
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:624
-