Analysis
-
max time kernel
152s -
max time network
93s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
18-05-2021 19:14
Behavioral task
behavioral1
Sample
cancel_sub_JPL12345678901234.xlsb
Resource
win7v20210408
Behavioral task
behavioral2
Sample
cancel_sub_JPL12345678901234.xlsb
Resource
win10v20210410
General
-
Target
cancel_sub_JPL12345678901234.xlsb
-
Size
241KB
-
MD5
b4a0b38ff2bd7619e42c0f1d1fb0171b
-
SHA1
c0e61bcc7139bc2342e5a9eb9a2bc056c475624d
-
SHA256
3cc4948d4d3cac89a74284ae4dc49d177b834f295e9f767a46dcd73726b7239d
-
SHA512
8830468a4f8ee1032abe7ede05fdc11fb592355c81447bf0d65b995a6d6a55fc399025084bb74bb7f4b52a14ee7a2ea79a2100480222c1da95e19b3b4a59cff5
Malware Config
Extracted
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 400 1080 cmd.exe EXCEL.EXE -
Nloader Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1596-73-0x00000000001A0000-0x00000000001A5000-memory.dmp nloader -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 1596 rundll32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 316 1596 WerFault.exe rundll32.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1080 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
WerFault.exepid process 316 WerFault.exe 316 WerFault.exe 316 WerFault.exe 316 WerFault.exe 316 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WerFault.exedescription pid process Token: SeDebugPrivilege 316 WerFault.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
EXCEL.EXEpid process 1080 EXCEL.EXE 1080 EXCEL.EXE 1080 EXCEL.EXE 1080 EXCEL.EXE 1080 EXCEL.EXE -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
EXCEL.EXEcmd.exerundll32.exedescription pid process target process PID 1080 wrote to memory of 784 1080 EXCEL.EXE splwow64.exe PID 1080 wrote to memory of 784 1080 EXCEL.EXE splwow64.exe PID 1080 wrote to memory of 784 1080 EXCEL.EXE splwow64.exe PID 1080 wrote to memory of 784 1080 EXCEL.EXE splwow64.exe PID 1080 wrote to memory of 400 1080 EXCEL.EXE cmd.exe PID 1080 wrote to memory of 400 1080 EXCEL.EXE cmd.exe PID 1080 wrote to memory of 400 1080 EXCEL.EXE cmd.exe PID 1080 wrote to memory of 400 1080 EXCEL.EXE cmd.exe PID 400 wrote to memory of 2000 400 cmd.exe certutil.exe PID 400 wrote to memory of 2000 400 cmd.exe certutil.exe PID 400 wrote to memory of 2000 400 cmd.exe certutil.exe PID 400 wrote to memory of 2000 400 cmd.exe certutil.exe PID 400 wrote to memory of 1596 400 cmd.exe rundll32.exe PID 400 wrote to memory of 1596 400 cmd.exe rundll32.exe PID 400 wrote to memory of 1596 400 cmd.exe rundll32.exe PID 400 wrote to memory of 1596 400 cmd.exe rundll32.exe PID 400 wrote to memory of 1596 400 cmd.exe rundll32.exe PID 400 wrote to memory of 1596 400 cmd.exe rundll32.exe PID 400 wrote to memory of 1596 400 cmd.exe rundll32.exe PID 1596 wrote to memory of 316 1596 rundll32.exe WerFault.exe PID 1596 wrote to memory of 316 1596 rundll32.exe WerFault.exe PID 1596 wrote to memory of 316 1596 rundll32.exe WerFault.exe PID 1596 wrote to memory of 316 1596 rundll32.exe WerFault.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\cancel_sub_JPL12345678901234.xlsb1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:784
-
C:\Windows\SysWOW64\cmd.execmd.exe /c certutil -decode C:\Users\Public\4802545.xs1 C:\Users\Public\4802545.xs2 && rundll32 C:\Users\Public\4802545.xs2,DF12⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Windows\SysWOW64\certutil.execertutil -decode C:\Users\Public\4802545.xs1 C:\Users\Public\4802545.xs23⤵PID:2000
-
C:\Windows\SysWOW64\rundll32.exerundll32 C:\Users\Public\4802545.xs2,DF13⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 4364⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:316
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
e3c91eeeec07ed08ff35991cd1f8926d
SHA17f4b8b7a2968977de612be4938e4d2563b388884
SHA256975509717b69e7c6dc7e20ac3421f710591df6b8b08f1fd93b042e44403db0b9
SHA512389f20e6f01a0a6707ad2aadce542612b3fbefeb7a586d140a471f765c84a1ec55ae19f1c4bef8d353881e1fdb16f2ae33cd9cfb3aae342f10628e54b51246da
-
MD5
cfb94c893280fd1edd40a4c74031727a
SHA19bf1f365e14842621854282f976b890478816a77
SHA2563205ebcea1f138f0171ff3815d594883805b4af48a24bc0d6228d0b0ee12ddb4
SHA51231b573054e5963c939cab24b48a8610f757ea94eba21c5101f2df3ffd8fc3120327795692feda7d448091a93b4befb389eed48e17662d7f2e3b19cc441a56988
-
MD5
cfb94c893280fd1edd40a4c74031727a
SHA19bf1f365e14842621854282f976b890478816a77
SHA2563205ebcea1f138f0171ff3815d594883805b4af48a24bc0d6228d0b0ee12ddb4
SHA51231b573054e5963c939cab24b48a8610f757ea94eba21c5101f2df3ffd8fc3120327795692feda7d448091a93b4befb389eed48e17662d7f2e3b19cc441a56988