Analysis
-
max time kernel
143s -
max time network
145s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
15-03-2021 16:07
Behavioral task
behavioral1
Sample
30bd80d57fe0b8bfeabc34dc3bb3b12b6741e6ee3bc4a74adb586e2939ef1f74.xls
Resource
win7v20201028
Behavioral task
behavioral2
Sample
30bd80d57fe0b8bfeabc34dc3bb3b12b6741e6ee3bc4a74adb586e2939ef1f74.xls
Resource
win10v20201028
General
-
Target
30bd80d57fe0b8bfeabc34dc3bb3b12b6741e6ee3bc4a74adb586e2939ef1f74.xls
-
Size
46KB
-
MD5
580afece57c22de1717921473c03e1a7
-
SHA1
5cbd73d78239dc355634f35abe63c7e76969a9b8
-
SHA256
30bd80d57fe0b8bfeabc34dc3bb3b12b6741e6ee3bc4a74adb586e2939ef1f74
-
SHA512
88c19a155154ed6b16da98e4351476656746f4c01f415130076fecf64e070d7d0940ced5fb33c3cc5f649abebc0c7f6547f31d67d97f291804e65de340840dc3
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rundll32.exedescription pid pid_target process target process Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1148 1888 rundll32.exe EXCEL.EXE -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 1148 rundll32.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1888 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1888 EXCEL.EXE 1888 EXCEL.EXE 1888 EXCEL.EXE -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
EXCEL.EXEdescription pid process target process PID 1888 wrote to memory of 1148 1888 EXCEL.EXE rundll32.exe PID 1888 wrote to memory of 1148 1888 EXCEL.EXE rundll32.exe PID 1888 wrote to memory of 1148 1888 EXCEL.EXE rundll32.exe PID 1888 wrote to memory of 1148 1888 EXCEL.EXE rundll32.exe PID 1888 wrote to memory of 1148 1888 EXCEL.EXE rundll32.exe PID 1888 wrote to memory of 1148 1888 EXCEL.EXE rundll32.exe PID 1888 wrote to memory of 1148 1888 EXCEL.EXE rundll32.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\30bd80d57fe0b8bfeabc34dc3bb3b12b6741e6ee3bc4a74adb586e2939ef1f74.xls1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32 ..\Jidai.moli,Start2⤵
- Process spawned unexpected child process
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Jidai.moliMD5
e61ff8f9a593f790ea844934fe2205b8
SHA19a62f2f058e3f44c446e2cecf4923f27d46bcdc9
SHA256940f205731c0428b999f486232f6b1d51d808bec9912a3ed1a49ddfa9d99335d
SHA5129823521265a6f89690e9acc33a7c957d81c2717f259747b0245eb4e175a0a6cbbfb456bdbe597838a70093932245ef5b4b6ea95dde57fe9c86ef90763684eacf
-
\Users\Admin\Jidai.moliMD5
e61ff8f9a593f790ea844934fe2205b8
SHA19a62f2f058e3f44c446e2cecf4923f27d46bcdc9
SHA256940f205731c0428b999f486232f6b1d51d808bec9912a3ed1a49ddfa9d99335d
SHA5129823521265a6f89690e9acc33a7c957d81c2717f259747b0245eb4e175a0a6cbbfb456bdbe597838a70093932245ef5b4b6ea95dde57fe9c86ef90763684eacf
-
memory/1148-6-0x0000000000000000-mapping.dmp
-
memory/1148-7-0x0000000075781000-0x0000000075783000-memory.dmpFilesize
8KB
-
memory/1716-5-0x000007FEF6080000-0x000007FEF62FA000-memory.dmpFilesize
2.5MB
-
memory/1888-2-0x000000002FF81000-0x000000002FF84000-memory.dmpFilesize
12KB
-
memory/1888-3-0x0000000071271000-0x0000000071273000-memory.dmpFilesize
8KB
-
memory/1888-4-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB