Analysis
-
max time kernel
43s -
max time network
53s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
14-07-2021 02:36
Behavioral task
behavioral1
Sample
subscription_1617291613.xlsb
Resource
win7v20210408
General
-
Target
subscription_1617291613.xlsb
-
Size
228KB
-
MD5
8a3364bafa63166394862068b05f5469
-
SHA1
b039cb7a479cf118d53c61e113ad74015caadd22
-
SHA256
3d0b681046147d8008b70bab97c41e3a21a283559874ac2ce0c518b6965312da
-
SHA512
27c70c7fd278222a17112c0e3deb16a84f36f080a6fd933d51c4cc73392654414991ae0ba99e9760008c40a865572380c03a3b3af9297cb1a3678c630ca18111
Malware Config
Extracted
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 456 760 cmd.exe EXCEL.EXE -
Nloader Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1588-70-0x00000000000D0000-0x00000000000D5000-memory.dmp nloader -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 1588 rundll32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 436 1588 WerFault.exe rundll32.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 760 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
WerFault.exepid process 436 WerFault.exe 436 WerFault.exe 436 WerFault.exe 436 WerFault.exe 436 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WerFault.exedescription pid process Token: SeDebugPrivilege 436 WerFault.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
EXCEL.EXEpid process 760 EXCEL.EXE 760 EXCEL.EXE 760 EXCEL.EXE 760 EXCEL.EXE 760 EXCEL.EXE 760 EXCEL.EXE 760 EXCEL.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
EXCEL.EXEcmd.exerundll32.exedescription pid process target process PID 760 wrote to memory of 456 760 EXCEL.EXE cmd.exe PID 760 wrote to memory of 456 760 EXCEL.EXE cmd.exe PID 760 wrote to memory of 456 760 EXCEL.EXE cmd.exe PID 760 wrote to memory of 456 760 EXCEL.EXE cmd.exe PID 456 wrote to memory of 1432 456 cmd.exe certutil.exe PID 456 wrote to memory of 1432 456 cmd.exe certutil.exe PID 456 wrote to memory of 1432 456 cmd.exe certutil.exe PID 456 wrote to memory of 1432 456 cmd.exe certutil.exe PID 456 wrote to memory of 1588 456 cmd.exe rundll32.exe PID 456 wrote to memory of 1588 456 cmd.exe rundll32.exe PID 456 wrote to memory of 1588 456 cmd.exe rundll32.exe PID 456 wrote to memory of 1588 456 cmd.exe rundll32.exe PID 456 wrote to memory of 1588 456 cmd.exe rundll32.exe PID 456 wrote to memory of 1588 456 cmd.exe rundll32.exe PID 456 wrote to memory of 1588 456 cmd.exe rundll32.exe PID 1588 wrote to memory of 436 1588 rundll32.exe WerFault.exe PID 1588 wrote to memory of 436 1588 rundll32.exe WerFault.exe PID 1588 wrote to memory of 436 1588 rundll32.exe WerFault.exe PID 1588 wrote to memory of 436 1588 rundll32.exe WerFault.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\subscription_1617291613.xlsb1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Windows\SysWOW64\cmd.execmd.exe /c certutil -decode %PUBLIC%\569390.pdi %PUBLIC%\569390.ui && rundll32 %PUBLIC%\569390.ui,DF12⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Windows\SysWOW64\certutil.execertutil -decode C:\Users\Public\569390.pdi C:\Users\Public\569390.ui3⤵PID:1432
-
-
C:\Windows\SysWOW64\rundll32.exerundll32 C:\Users\Public\569390.ui,DF13⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1588 -s 4324⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:436
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
5cc5f895b91ab4c1835ac9b83e86663b
SHA1b51565a65b167172b71516435f4118ec9a278673
SHA25681a75221faf7f28e2b2ce76471499d72b94da9ae48e0e1dc5bf01060e9195065
SHA5123a4289acdc392d999f4edde46c4261956b9be0aba355dc730a7bee08b9b00dff8733f84c97365aa773fad8bde29aa8dc040aac3067e7af3e7f75049c897e08f0
-
MD5
f4dc5b1151ed77bfcfae8b73147d93c2
SHA1e53166ca0f09ad46795cd8f5a1c9a4a2d5b21415
SHA25671cd6cb93fcf508761b72fac05bc96a07697718eb928c72fc7731dab457b3606
SHA512077b54dc49c0596ead6b5f754c77deecbda5d7dfee34c21b3d5faab727c8a83804c7da4652597905f5428ab52f2cd10eabbbaae12e30d3a5ccebba0b4ce479eb
-
MD5
f4dc5b1151ed77bfcfae8b73147d93c2
SHA1e53166ca0f09ad46795cd8f5a1c9a4a2d5b21415
SHA25671cd6cb93fcf508761b72fac05bc96a07697718eb928c72fc7731dab457b3606
SHA512077b54dc49c0596ead6b5f754c77deecbda5d7dfee34c21b3d5faab727c8a83804c7da4652597905f5428ab52f2cd10eabbbaae12e30d3a5ccebba0b4ce479eb