Analysis
-
max time kernel
102s -
max time network
17s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
08-04-2021 07:59
Static task
static1
Behavioral task
behavioral1
Sample
RFx 6300306423.xlsx
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
RFx 6300306423.xlsx
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
RFx 6300306423.xlsx
-
Size
137KB
-
MD5
9febf3fe31dc5704361e221d53a75c03
-
SHA1
a833fd9e821506ad7cd05cacb4242100e86748ec
-
SHA256
953a6306d8a67dd42a51ea07f5e77ec77888052ae02e6bf385305d5c10397a59
-
SHA512
a2e565451cc36842a91b0719d449ab95f43acf9d467e1cf4f5271ccffb9bb592c82269453565ef010208337a26941947d13a20f29cb9af8c28e78c1783c73fb1
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 3 IoCs
Processes:
EQNEDT32.EXEflow pid process 4 1676 EQNEDT32.EXE 7 1676 EQNEDT32.EXE 8 1676 EQNEDT32.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 784 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 784 EXCEL.EXE 784 EXCEL.EXE 784 EXCEL.EXE
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\RFx 6300306423.xlsx"1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Launches Equation Editor
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/784-60-0x000000002F961000-0x000000002F964000-memory.dmpFilesize
12KB
-
memory/784-61-0x0000000071281000-0x0000000071283000-memory.dmpFilesize
8KB
-
memory/784-62-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/784-64-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1676-63-0x00000000761E1000-0x00000000761E3000-memory.dmpFilesize
8KB