Analysis
-
max time kernel
72s -
max time network
13s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
11-06-2021 09:54
Behavioral task
behavioral1
Sample
a.xlsb
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
a.xlsb
-
Size
155KB
-
MD5
79d94d53703ee58ab2aac1782cbd6939
-
SHA1
16a918e278d56ed854a3314d2a4ea907001195fc
-
SHA256
80afad8cad6c0a84c232d5d17354b11ff9e5920d65c2552047801bc73a8bec82
-
SHA512
912a3ea6a5f75b35376ac34b03605ffd660376ad2f201648a0b73b79159c35f051842ba0585ad075bdd2424940dc671082f2cdf178e53c4c6cfdd072c3a7dcd9
Score
10/10
Malware Config
Extracted
Language
xlm4.0
Source
URLs
xlm40.dropper
https://shadiinfo.com/2DP6mQeg/pt.html
xlm40.dropper
https://treasurechestcaribbean.com/pZ2Z61bqa/pt.html
Signatures
-
Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
regsvr32.exeregsvr32.exedescription pid pid_target process target process Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1684 2004 regsvr32.exe EXCEL.EXE Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 548 2004 regsvr32.exe EXCEL.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 2004 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
EXCEL.EXEpid process 2004 EXCEL.EXE 2004 EXCEL.EXE 2004 EXCEL.EXE 2004 EXCEL.EXE 2004 EXCEL.EXE 2004 EXCEL.EXE 2004 EXCEL.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
EXCEL.EXEdescription pid process target process PID 2004 wrote to memory of 1740 2004 EXCEL.EXE splwow64.exe PID 2004 wrote to memory of 1740 2004 EXCEL.EXE splwow64.exe PID 2004 wrote to memory of 1740 2004 EXCEL.EXE splwow64.exe PID 2004 wrote to memory of 1740 2004 EXCEL.EXE splwow64.exe PID 2004 wrote to memory of 1684 2004 EXCEL.EXE regsvr32.exe PID 2004 wrote to memory of 1684 2004 EXCEL.EXE regsvr32.exe PID 2004 wrote to memory of 1684 2004 EXCEL.EXE regsvr32.exe PID 2004 wrote to memory of 1684 2004 EXCEL.EXE regsvr32.exe PID 2004 wrote to memory of 1684 2004 EXCEL.EXE regsvr32.exe PID 2004 wrote to memory of 1684 2004 EXCEL.EXE regsvr32.exe PID 2004 wrote to memory of 1684 2004 EXCEL.EXE regsvr32.exe PID 2004 wrote to memory of 548 2004 EXCEL.EXE regsvr32.exe PID 2004 wrote to memory of 548 2004 EXCEL.EXE regsvr32.exe PID 2004 wrote to memory of 548 2004 EXCEL.EXE regsvr32.exe PID 2004 wrote to memory of 548 2004 EXCEL.EXE regsvr32.exe PID 2004 wrote to memory of 548 2004 EXCEL.EXE regsvr32.exe PID 2004 wrote to memory of 548 2004 EXCEL.EXE regsvr32.exe PID 2004 wrote to memory of 548 2004 EXCEL.EXE regsvr32.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\a.xlsb1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 -s ..\covi1.dll2⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 -s ..\covi2.dll2⤵
- Process spawned unexpected child process
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/548-67-0x0000000000000000-mapping.dmp
-
memory/1684-65-0x0000000000000000-mapping.dmp
-
memory/1684-66-0x00000000765F1000-0x00000000765F3000-memory.dmpFilesize
8KB
-
memory/1740-63-0x0000000000000000-mapping.dmp
-
memory/1740-64-0x000007FEFC411000-0x000007FEFC413000-memory.dmpFilesize
8KB
-
memory/2004-60-0x000000002FF01000-0x000000002FF04000-memory.dmpFilesize
12KB
-
memory/2004-61-0x0000000071CC1000-0x0000000071CC3000-memory.dmpFilesize
8KB
-
memory/2004-62-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB