01fe11c86a69bca1d91f1d6f3aa776bd7871c57973e6f98915f60dd514ddd913

General

Target

subscription_1618608166.xlsb
Size

269KB
MD5

0565d0498becf85051e0d80b65f87a54
SHA1

db53dda3a6954348adb45009c97ade36a1ff3de3
SHA256

01fe11c86a69bca1d91f1d6f3aa776bd7871c57973e6f98915f60dd514ddd913
SHA512

7a1c24042ffd4df0ce831b36b91780b6fc3b523e0960ac865edb5c14a37378ab15bd1dee4144f4ba66796eb0cdb2a21ebc907de1e2d3c2ed538b8925c30472e5

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cmd.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	2476	2228	cmd.exe	EXCEL.EXE

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

3976 rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1744 3976 WerFault.exe rundll32.exe

pid	process
3976	rundll32.exe

pid	pid_target	process	target process
1744	3976	WerFault.exe	rundll32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

2228 EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

WerFault.exe

pid	process
1744	WerFault.exe
1744	WerFault.exe
1744	WerFault.exe
1744	WerFault.exe
1744	WerFault.exe
1744	WerFault.exe
1744	WerFault.exe
1744	WerFault.exe
1744	WerFault.exe
1744	WerFault.exe
1744	WerFault.exe
1744	WerFault.exe
1744	WerFault.exe
1744	WerFault.exe
1744	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1744 WerFault.exe
Token: SeBackupPrivilege 1744 WerFault.exe
Token: SeDebugPrivilege 1744 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	1744	WerFault.exe
Token: SeBackupPrivilege	1744	WerFault.exe
Token: SeDebugPrivilege	1744	WerFault.exe

Suspicious use of SetWindowsHookEx 22 IoCs

Processes:

EXCEL.EXE

pid	process
2228	EXCEL.EXE
2228	EXCEL.EXE
2228	EXCEL.EXE
2228	EXCEL.EXE
2228	EXCEL.EXE
2228	EXCEL.EXE
2228	EXCEL.EXE
2228	EXCEL.EXE
2228	EXCEL.EXE
2228	EXCEL.EXE
2228	EXCEL.EXE
2228	EXCEL.EXE
2228	EXCEL.EXE
2228	EXCEL.EXE
2228	EXCEL.EXE
2228	EXCEL.EXE
2228	EXCEL.EXE
2228	EXCEL.EXE
2228	EXCEL.EXE
2228	EXCEL.EXE
2228	EXCEL.EXE
2228	EXCEL.EXE

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

EXCEL.EXEcmd.exerundll32.exe

description	pid	process	target process
PID 2228 wrote to memory of 2476	2228	EXCEL.EXE	cmd.exe
PID 2228 wrote to memory of 2476	2228	EXCEL.EXE	cmd.exe
PID 2476 wrote to memory of 1292	2476	cmd.exe	certutil.exe
PID 2476 wrote to memory of 1292	2476	cmd.exe	certutil.exe
PID 2476 wrote to memory of 3408	2476	cmd.exe	rundll32.exe
PID 2476 wrote to memory of 3408	2476	cmd.exe	rundll32.exe
PID 3408 wrote to memory of 3976	3408	rundll32.exe	rundll32.exe
PID 3408 wrote to memory of 3976	3408	rundll32.exe	rundll32.exe
PID 3408 wrote to memory of 3976	3408	rundll32.exe	rundll32.exe

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\subscription_1618608166.xlsb"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2228

C:\Windows\SYSTEM32\cmd.exe
cmd.exe /c certutil -decode %PUBLIC%\496258.dof %PUBLIC%\496258.doh && rundll32 %PUBLIC%\496258.doh,DF1
2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2476

C:\Windows\system32\certutil.exe
certutil -decode C:\Users\Public\496258.dof C:\Users\Public\496258.doh
3⤵
PID:1292

C:\Windows\system32\rundll32.exe
rundll32 C:\Users\Public\496258.doh,DF1
3⤵
- Suspicious use of WriteProcessMemory
PID:3408

C:\Windows\SysWOW64\rundll32.exe
rundll32 C:\Users\Public\496258.doh,DF1
4⤵
- Loads dropped DLL
PID:3976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3976 -s 828
5⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1744

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\496258.dof

MD5
f7e72deaacfad01ce83511f7a0573d42

SHA1
e07f231d8d1911964918f1d593a1b8ccde2aec59

SHA256
65078cbb043f24bb3bdad6f2ff82996d9e6d4f55334f9b3bb642b10448cd852e

SHA512
0877fd332e9829b6ca20b1aa32b3fd8fc727a197f9c2517c2c23fc8b8abf73be4b52732f124254d623c633934af9eb6f8f81dda4e8407375c548360f34129517

Download Submit
C:\Users\Public\496258.doh

MD5
95855134f3999425d0614e14e11ac0f8

SHA1
bff84288beaf968b658b176c15695f6ec1386113

SHA256
37d298ab9d815c7ec02ac0a304e114ddf1b27593f522dd881de094ab753ef33a

SHA512
9f5a438a12218ec21037345fab813d1b9aa43174db13ebba419ed884a4534ac296e2ea6179b87b032feb696281167004bc003bd2c9e8c56784f4cd7ef02dd929

Download Submit
\Users\Public\496258.doh

MD5
95855134f3999425d0614e14e11ac0f8

SHA1
bff84288beaf968b658b176c15695f6ec1386113

SHA256
37d298ab9d815c7ec02ac0a304e114ddf1b27593f522dd881de094ab753ef33a

SHA512
9f5a438a12218ec21037345fab813d1b9aa43174db13ebba419ed884a4534ac296e2ea6179b87b032feb696281167004bc003bd2c9e8c56784f4cd7ef02dd929

Download Submit
memory/1292-180-0x0000000000000000-mapping.dmp

Download
memory/2228-117-0x00007FF8383E0000-0x00007FF8383F0000-memory.dmp

Filesize
64KB

Download
memory/2228-122-0x00007FF8383E0000-0x00007FF8383F0000-memory.dmp

Filesize
64KB

Download
memory/2228-121-0x00007FF859140000-0x00007FF85A22E000-memory.dmp

Filesize
16.9MB

Download
memory/2228-123-0x000001FFE5E50000-0x000001FFE7D45000-memory.dmp

Filesize
31.0MB

Download
memory/2228-118-0x00007FF8383E0000-0x00007FF8383F0000-memory.dmp

Filesize
64KB

Download
memory/2228-114-0x00007FF620EE0000-0x00007FF624496000-memory.dmp

Filesize
53.7MB

Download
memory/2228-116-0x00007FF8383E0000-0x00007FF8383F0000-memory.dmp

Filesize
64KB

Download
memory/2228-115-0x00007FF8383E0000-0x00007FF8383F0000-memory.dmp

Filesize
64KB

Download
memory/2476-179-0x0000000000000000-mapping.dmp

Download
memory/3408-182-0x0000000000000000-mapping.dmp

Download
memory/3976-184-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads