Analysis
-
max time kernel
145s -
max time network
134s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
18-05-2021 19:14
Behavioral task
behavioral1
Sample
cancel_sub_JPL12345678901234.xlsb
Resource
win7v20210408
Behavioral task
behavioral2
Sample
cancel_sub_JPL12345678901234.xlsb
Resource
win10v20210410
General
-
Target
cancel_sub_JPL12345678901234.xlsb
-
Size
241KB
-
MD5
b4a0b38ff2bd7619e42c0f1d1fb0171b
-
SHA1
c0e61bcc7139bc2342e5a9eb9a2bc056c475624d
-
SHA256
3cc4948d4d3cac89a74284ae4dc49d177b834f295e9f767a46dcd73726b7239d
-
SHA512
8830468a4f8ee1032abe7ede05fdc11fb592355c81447bf0d65b995a6d6a55fc399025084bb74bb7f4b52a14ee7a2ea79a2100480222c1da95e19b3b4a59cff5
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 4044 4060 cmd.exe EXCEL.EXE -
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 41 1424 rundll32.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 1424 rundll32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 4060 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid process 4060 EXCEL.EXE 4060 EXCEL.EXE 4060 EXCEL.EXE 4060 EXCEL.EXE 4060 EXCEL.EXE 4060 EXCEL.EXE 4060 EXCEL.EXE 4060 EXCEL.EXE 4060 EXCEL.EXE 4060 EXCEL.EXE 4060 EXCEL.EXE 4060 EXCEL.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
EXCEL.EXEcmd.exerundll32.exedescription pid process target process PID 4060 wrote to memory of 3200 4060 EXCEL.EXE splwow64.exe PID 4060 wrote to memory of 3200 4060 EXCEL.EXE splwow64.exe PID 4060 wrote to memory of 4044 4060 EXCEL.EXE cmd.exe PID 4060 wrote to memory of 4044 4060 EXCEL.EXE cmd.exe PID 4044 wrote to memory of 880 4044 cmd.exe certutil.exe PID 4044 wrote to memory of 880 4044 cmd.exe certutil.exe PID 4044 wrote to memory of 1896 4044 cmd.exe rundll32.exe PID 4044 wrote to memory of 1896 4044 cmd.exe rundll32.exe PID 1896 wrote to memory of 1424 1896 rundll32.exe rundll32.exe PID 1896 wrote to memory of 1424 1896 rundll32.exe rundll32.exe PID 1896 wrote to memory of 1424 1896 rundll32.exe rundll32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\cancel_sub_JPL12345678901234.xlsb"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:3200
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c certutil -decode C:\Users\Public\4802545.xs1 C:\Users\Public\4802545.xs2 && rundll32 C:\Users\Public\4802545.xs2,DF12⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Windows\system32\certutil.execertutil -decode C:\Users\Public\4802545.xs1 C:\Users\Public\4802545.xs23⤵PID:880
-
C:\Windows\system32\rundll32.exerundll32 C:\Users\Public\4802545.xs2,DF13⤵
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Windows\SysWOW64\rundll32.exerundll32 C:\Users\Public\4802545.xs2,DF14⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:1424
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
e3c91eeeec07ed08ff35991cd1f8926d
SHA17f4b8b7a2968977de612be4938e4d2563b388884
SHA256975509717b69e7c6dc7e20ac3421f710591df6b8b08f1fd93b042e44403db0b9
SHA512389f20e6f01a0a6707ad2aadce542612b3fbefeb7a586d140a471f765c84a1ec55ae19f1c4bef8d353881e1fdb16f2ae33cd9cfb3aae342f10628e54b51246da
-
MD5
cfb94c893280fd1edd40a4c74031727a
SHA19bf1f365e14842621854282f976b890478816a77
SHA2563205ebcea1f138f0171ff3815d594883805b4af48a24bc0d6228d0b0ee12ddb4
SHA51231b573054e5963c939cab24b48a8610f757ea94eba21c5101f2df3ffd8fc3120327795692feda7d448091a93b4befb389eed48e17662d7f2e3b19cc441a56988
-
MD5
cfb94c893280fd1edd40a4c74031727a
SHA19bf1f365e14842621854282f976b890478816a77
SHA2563205ebcea1f138f0171ff3815d594883805b4af48a24bc0d6228d0b0ee12ddb4
SHA51231b573054e5963c939cab24b48a8610f757ea94eba21c5101f2df3ffd8fc3120327795692feda7d448091a93b4befb389eed48e17662d7f2e3b19cc441a56988