6d6ff6f138defb2bb7602c08c1cb22930f5e30ef264eeaf760f99d4ca95beca7

General

Target

subscription_1618592996.xlsb
Size

269KB
MD5

e86b9229ec1b692dff17c074843d27da
SHA1

61598ee67b6f4f5ac01a5f0752dfe3324d00c66f
SHA256

6d6ff6f138defb2bb7602c08c1cb22930f5e30ef264eeaf760f99d4ca95beca7
SHA512

a8f9105ab7b360c492e0409d1d5b3912eba29fe2175036af676083a145f0a80b5924745d3b64b8ac82f499ac3c16df15c6650f30ea9bb006cca30931984e265b

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cmd.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	3428	640	cmd.exe	EXCEL.EXE

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

33 900 rundll32.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

900 rundll32.exe

flow	pid	process
33	900	rundll32.exe

pid	process
900	rundll32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

640 EXCEL.EXE
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

EXCEL.EXE

pid process

640 EXCEL.EXE
640 EXCEL.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

EXCEL.EXE

pid	process
640	EXCEL.EXE
640	EXCEL.EXE
640	EXCEL.EXE
640	EXCEL.EXE
640	EXCEL.EXE
640	EXCEL.EXE
640	EXCEL.EXE
640	EXCEL.EXE
640	EXCEL.EXE
640	EXCEL.EXE
640	EXCEL.EXE
640	EXCEL.EXE

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

EXCEL.EXEcmd.exerundll32.exe

description	pid	process	target process
PID 640 wrote to memory of 3428	640	EXCEL.EXE	cmd.exe
PID 640 wrote to memory of 3428	640	EXCEL.EXE	cmd.exe
PID 3428 wrote to memory of 3692	3428	cmd.exe	certutil.exe
PID 3428 wrote to memory of 3692	3428	cmd.exe	certutil.exe
PID 3428 wrote to memory of 2108	3428	cmd.exe	rundll32.exe
PID 3428 wrote to memory of 2108	3428	cmd.exe	rundll32.exe
PID 2108 wrote to memory of 900	2108	rundll32.exe	rundll32.exe
PID 2108 wrote to memory of 900	2108	rundll32.exe	rundll32.exe
PID 2108 wrote to memory of 900	2108	rundll32.exe	rundll32.exe

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\subscription_1618592996.xlsb"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:640

C:\Windows\SYSTEM32\cmd.exe
cmd.exe /c certutil -decode %PUBLIC%\496258.dof %PUBLIC%\496258.doh && rundll32 %PUBLIC%\496258.doh,DF1
2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:3428

C:\Windows\system32\certutil.exe
certutil -decode C:\Users\Public\496258.dof C:\Users\Public\496258.doh
3⤵
PID:3692

C:\Windows\system32\rundll32.exe
rundll32 C:\Users\Public\496258.doh,DF1
3⤵
- Suspicious use of WriteProcessMemory
PID:2108

C:\Windows\SysWOW64\rundll32.exe
rundll32 C:\Users\Public\496258.doh,DF1
4⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:900

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\496258.dof

MD5
f7e72deaacfad01ce83511f7a0573d42

SHA1
e07f231d8d1911964918f1d593a1b8ccde2aec59

SHA256
65078cbb043f24bb3bdad6f2ff82996d9e6d4f55334f9b3bb642b10448cd852e

SHA512
0877fd332e9829b6ca20b1aa32b3fd8fc727a197f9c2517c2c23fc8b8abf73be4b52732f124254d623c633934af9eb6f8f81dda4e8407375c548360f34129517

Download Submit
C:\Users\Public\496258.doh

MD5
95855134f3999425d0614e14e11ac0f8

SHA1
bff84288beaf968b658b176c15695f6ec1386113

SHA256
37d298ab9d815c7ec02ac0a304e114ddf1b27593f522dd881de094ab753ef33a

SHA512
9f5a438a12218ec21037345fab813d1b9aa43174db13ebba419ed884a4534ac296e2ea6179b87b032feb696281167004bc003bd2c9e8c56784f4cd7ef02dd929

Download Submit
\Users\Public\496258.doh

MD5
95855134f3999425d0614e14e11ac0f8

SHA1
bff84288beaf968b658b176c15695f6ec1386113

SHA256
37d298ab9d815c7ec02ac0a304e114ddf1b27593f522dd881de094ab753ef33a

SHA512
9f5a438a12218ec21037345fab813d1b9aa43174db13ebba419ed884a4534ac296e2ea6179b87b032feb696281167004bc003bd2c9e8c56784f4cd7ef02dd929

Download Submit
memory/640-122-0x00007FFAE5120000-0x00007FFAE620E000-memory.dmp

Filesize
16.9MB

Download
memory/640-118-0x00007FFAC4B10000-0x00007FFAC4B20000-memory.dmp

Filesize
64KB

Download
memory/640-121-0x00007FFAC4B10000-0x00007FFAC4B20000-memory.dmp

Filesize
64KB

Download
memory/640-114-0x00007FF79CF60000-0x00007FF7A0516000-memory.dmp

Filesize
53.7MB

Download
memory/640-123-0x00007FFAE3220000-0x00007FFAE5115000-memory.dmp

Filesize
31.0MB

Download
memory/640-117-0x00007FFAC4B10000-0x00007FFAC4B20000-memory.dmp

Filesize
64KB

Download
memory/640-116-0x00007FFAC4B10000-0x00007FFAC4B20000-memory.dmp

Filesize
64KB

Download
memory/640-115-0x00007FFAC4B10000-0x00007FFAC4B20000-memory.dmp

Filesize
64KB

Download
memory/900-184-0x0000000000000000-mapping.dmp

Download
memory/2108-182-0x0000000000000000-mapping.dmp

Download
memory/3428-179-0x0000000000000000-mapping.dmp

Download
memory/3692-180-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads