Analysis
-
max time kernel
146s -
max time network
148s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
29-09-2021 11:34
Static task
static1
Behavioral task
behavioral1
Sample
recital-1267320846.xls
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
General
-
Target
recital-1267320846.xls
-
Size
244KB
-
MD5
fa6369788a5f5490d4c506e65b82a166
-
SHA1
f12d615a708cd6e83c669e3a16c1bebbf2510718
-
SHA256
3f3f21189390158abe6d01848ce995c762f3b0e908ea27192778effb160a6014
-
SHA512
a0cf692797d8a9c232de08f15fe251380cdeb54835f5025a5605782d5a55fe4975a0d3fc2174093350b7d533a55ac2bbbea7dbf443a3389abf8c559c1e0f63e9
Score
10/10
Malware Config
Extracted
Language
xlm4.0
Source
URLs
xlm40.dropper
https://gillcart.com/Cdpmoyhr/key.xml
xlm40.dropper
https://geit.in/MeOlE9Xxd/key.xml
xlm40.dropper
https://mercanets.com/9DPZqAfZdq5z/key.xml
Signatures
-
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
regsvr32.exeregsvr32.exeregsvr32.exedescription pid pid_target process target process Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1880 1724 regsvr32.exe EXCEL.EXE Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1300 1724 regsvr32.exe EXCEL.EXE Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 552 1724 regsvr32.exe EXCEL.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Processes:
EXCEL.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1724 EXCEL.EXE -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
EXCEL.EXEregsvr32.exepid process 1724 EXCEL.EXE 1880 regsvr32.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
EXCEL.EXEpid process 1724 EXCEL.EXE 1724 EXCEL.EXE 1724 EXCEL.EXE 1724 EXCEL.EXE 1724 EXCEL.EXE 1724 EXCEL.EXE -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
EXCEL.EXEdescription pid process target process PID 1724 wrote to memory of 1880 1724 EXCEL.EXE regsvr32.exe PID 1724 wrote to memory of 1880 1724 EXCEL.EXE regsvr32.exe PID 1724 wrote to memory of 1880 1724 EXCEL.EXE regsvr32.exe PID 1724 wrote to memory of 1880 1724 EXCEL.EXE regsvr32.exe PID 1724 wrote to memory of 1880 1724 EXCEL.EXE regsvr32.exe PID 1724 wrote to memory of 1880 1724 EXCEL.EXE regsvr32.exe PID 1724 wrote to memory of 1880 1724 EXCEL.EXE regsvr32.exe PID 1724 wrote to memory of 1300 1724 EXCEL.EXE regsvr32.exe PID 1724 wrote to memory of 1300 1724 EXCEL.EXE regsvr32.exe PID 1724 wrote to memory of 1300 1724 EXCEL.EXE regsvr32.exe PID 1724 wrote to memory of 1300 1724 EXCEL.EXE regsvr32.exe PID 1724 wrote to memory of 1300 1724 EXCEL.EXE regsvr32.exe PID 1724 wrote to memory of 1300 1724 EXCEL.EXE regsvr32.exe PID 1724 wrote to memory of 1300 1724 EXCEL.EXE regsvr32.exe PID 1724 wrote to memory of 552 1724 EXCEL.EXE regsvr32.exe PID 1724 wrote to memory of 552 1724 EXCEL.EXE regsvr32.exe PID 1724 wrote to memory of 552 1724 EXCEL.EXE regsvr32.exe PID 1724 wrote to memory of 552 1724 EXCEL.EXE regsvr32.exe PID 1724 wrote to memory of 552 1724 EXCEL.EXE regsvr32.exe PID 1724 wrote to memory of 552 1724 EXCEL.EXE regsvr32.exe PID 1724 wrote to memory of 552 1724 EXCEL.EXE regsvr32.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\recital-1267320846.xls1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" C:\Datop\test.test2⤵
- Process spawned unexpected child process
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" C:\Datop\test1.test2⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" C:\Datop\test2.test2⤵
- Process spawned unexpected child process
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/552-60-0x0000000000000000-mapping.dmp
-
memory/552-64-0x0000000000200000-0x0000000000201000-memory.dmpFilesize
4KB
-
memory/1300-58-0x0000000000000000-mapping.dmp
-
memory/1300-59-0x0000000075661000-0x0000000075663000-memory.dmpFilesize
8KB
-
memory/1300-65-0x0000000000280000-0x0000000000281000-memory.dmpFilesize
4KB
-
memory/1724-54-0x000000002F901000-0x000000002F904000-memory.dmpFilesize
12KB
-
memory/1724-55-0x00000000716A1000-0x00000000716A3000-memory.dmpFilesize
8KB
-
memory/1724-56-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1880-57-0x0000000000000000-mapping.dmp
-
memory/1880-63-0x0000000000310000-0x0000000000311000-memory.dmpFilesize
4KB