2613196c01bb5676ebf85b913762efc9f7c2b64bb0b80ee7580f5ab74a5a0192

General

Target

359.xls
Size

58KB
MD5

d7e28031147b036422fb0920d767c4b0
SHA1

edfa5aa852b506c78f3f95b541baaa8c81efbb83
SHA256

2613196c01bb5676ebf85b913762efc9f7c2b64bb0b80ee7580f5ab74a5a0192
SHA512

31850a02c4a8e3be38407457f4479e20b6bed06cf7d8daff7709d7eecf77de23436dd9172f6bcc2fb909984dce0e7b19dbc5840eb7a418f588d1e82cf1d8558c

Score

10^/10

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

https://solemnenterprise.com/k.php

Signatures

Process spawned unexpected child process 2 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

reg.exerundll32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	304	1888	reg.exe	EXCEL.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	648	1888	rundll32.exe	EXCEL.EXE

Deletes itself 1 IoCs

Processes:

EXCEL.EXE

pid process

1888 EXCEL.EXE
Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

EXCEL.EXE

description ioc process

Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

EXCEL.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1888 EXCEL.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

EXCEL.EXE

pid	process
1888	EXCEL.EXE
1888	EXCEL.EXE
1888	EXCEL.EXE
1888	EXCEL.EXE
1888	EXCEL.EXE
1888	EXCEL.EXE
1888	EXCEL.EXE
1888	EXCEL.EXE
1888	EXCEL.EXE
1888	EXCEL.EXE
1888	EXCEL.EXE
1888	EXCEL.EXE

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

EXCEL.EXE

description	pid	process	target process
PID 1888 wrote to memory of 304	1888	EXCEL.EXE	reg.exe
PID 1888 wrote to memory of 304	1888	EXCEL.EXE	reg.exe
PID 1888 wrote to memory of 304	1888	EXCEL.EXE	reg.exe
PID 1888 wrote to memory of 304	1888	EXCEL.EXE	reg.exe
PID 1888 wrote to memory of 648	1888	EXCEL.EXE	rundll32.exe
PID 1888 wrote to memory of 648	1888	EXCEL.EXE	rundll32.exe
PID 1888 wrote to memory of 648	1888	EXCEL.EXE	rundll32.exe
PID 1888 wrote to memory of 648	1888	EXCEL.EXE	rundll32.exe
PID 1888 wrote to memory of 648	1888	EXCEL.EXE	rundll32.exe
PID 1888 wrote to memory of 648	1888	EXCEL.EXE	rundll32.exe
PID 1888 wrote to memory of 648	1888	EXCEL.EXE	rundll32.exe

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\359.xls
1⤵
- Deletes itself
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1888

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" EXPORT HKCU\Software\Microsoft\Office\14.0\Excel\Security C:\Users\Public\Documents\euLPwsjt.txt /y
2⤵
- Process spawned unexpected child process
PID:304

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Users\Public\Documents\xfgTeVf.txt,DllRegisterServer
2⤵
- Process spawned unexpected child process
PID:648

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Documents\euLPwsjt.txt
MD5
42db97055456144c49de5ad96c5e0c9a

SHA1
4e2f5a80036936b7778b12ed1bfa510d00dcc847

SHA256
b96c1f4a42cdcaf72dc20de12b6d5e7ce1ade5a8f61ba11b68cac780452ef547

SHA512
bfd01ce3486e0f2b4915dcdd7e78480993ff495ea718c222ec883b81919e60ef4776082868ccaf6daf343b2c4cb704fdbf106f6b9db6164a6a267ea1fc634390

Download Submit
C:\Users\Public\Documents\xfgTeVf.txt
MD5
888685d6b4731f0d808a7dd340d33581

SHA1
50739a966853c04ebba17e9206595800a2288da3

SHA256
f64cff91c9813a48459750cbe5af9bbfb5899411c60cd427142304e7af88d000

SHA512
1c7f242f3dcd753e6a6400e2b268e37846cdfaf72d385caca9dca1612778f5f648d00179b62aeded8d04000afcd0d95c501bd0955e961e61fc034a83e56ef0eb

Download Submit
memory/304-5-0x0000000000000000-mapping.dmp

Download
memory/648-8-0x0000000000000000-mapping.dmp

Download
memory/648-9-0x0000000075781000-0x0000000075783000-memory.dmp

Filesize
8KB

Download
memory/804-7-0x000007FEF5FA0000-0x000007FEF621A000-memory.dmp

Filesize
2.5MB

Download
memory/1888-2-0x000000002F321000-0x000000002F324000-memory.dmp

Filesize
12KB

Download
memory/1888-3-0x0000000071271000-0x0000000071273000-memory.dmp

Filesize
8KB

Download
memory/1888-4-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads