Resubmissions
09-12-2021 18:02
211209-wmyz3aeefp 1009-12-2021 13:52
211209-q6fpyadeck 1018-10-2021 09:36
211018-lkztgaecbm 1004-10-2021 17:53
211004-wgpjfaggb4 10Analysis
-
max time kernel
122s -
max time network
60s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
04-10-2021 17:53
Behavioral task
behavioral1
Sample
Invoice-5959498320211004.xlsb
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Invoice-5959498320211004.xlsb
Resource
win10-en-20210920
windows10_x64
0 signatures
0 seconds
General
-
Target
Invoice-5959498320211004.xlsb
-
Size
132KB
-
MD5
887bc475305003bdc34e671a2f3bd080
-
SHA1
7625f787be7479bf54addeff0ce7107cf0f59f23
-
SHA256
7e0b4b26bafd471703fac1db25b24936230aecad95732e66420184d717a111ee
-
SHA512
efb52e8c1fdf6e7cbc80b951220e25c78be0aad5c24b732696784b9b4d5d2c7a284df11fb0f524f64fa3f39a887069599c91f5233062d2aa8c01617104dd9ccd
Score
10/10
Malware Config
Signatures
-
Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1640 2004 wmic.exe 24 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 652 1668 mshta.exe 30 -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2004 EXCEL.EXE -
Suspicious use of AdjustPrivilegeToken 40 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1640 wmic.exe Token: SeSecurityPrivilege 1640 wmic.exe Token: SeTakeOwnershipPrivilege 1640 wmic.exe Token: SeLoadDriverPrivilege 1640 wmic.exe Token: SeSystemProfilePrivilege 1640 wmic.exe Token: SeSystemtimePrivilege 1640 wmic.exe Token: SeProfSingleProcessPrivilege 1640 wmic.exe Token: SeIncBasePriorityPrivilege 1640 wmic.exe Token: SeCreatePagefilePrivilege 1640 wmic.exe Token: SeBackupPrivilege 1640 wmic.exe Token: SeRestorePrivilege 1640 wmic.exe Token: SeShutdownPrivilege 1640 wmic.exe Token: SeDebugPrivilege 1640 wmic.exe Token: SeSystemEnvironmentPrivilege 1640 wmic.exe Token: SeRemoteShutdownPrivilege 1640 wmic.exe Token: SeUndockPrivilege 1640 wmic.exe Token: SeManageVolumePrivilege 1640 wmic.exe Token: 33 1640 wmic.exe Token: 34 1640 wmic.exe Token: 35 1640 wmic.exe Token: SeIncreaseQuotaPrivilege 1640 wmic.exe Token: SeSecurityPrivilege 1640 wmic.exe Token: SeTakeOwnershipPrivilege 1640 wmic.exe Token: SeLoadDriverPrivilege 1640 wmic.exe Token: SeSystemProfilePrivilege 1640 wmic.exe Token: SeSystemtimePrivilege 1640 wmic.exe Token: SeProfSingleProcessPrivilege 1640 wmic.exe Token: SeIncBasePriorityPrivilege 1640 wmic.exe Token: SeCreatePagefilePrivilege 1640 wmic.exe Token: SeBackupPrivilege 1640 wmic.exe Token: SeRestorePrivilege 1640 wmic.exe Token: SeShutdownPrivilege 1640 wmic.exe Token: SeDebugPrivilege 1640 wmic.exe Token: SeSystemEnvironmentPrivilege 1640 wmic.exe Token: SeRemoteShutdownPrivilege 1640 wmic.exe Token: SeUndockPrivilege 1640 wmic.exe Token: SeManageVolumePrivilege 1640 wmic.exe Token: 33 1640 wmic.exe Token: 34 1640 wmic.exe Token: 35 1640 wmic.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2004 EXCEL.EXE 2004 EXCEL.EXE 2004 EXCEL.EXE 2004 EXCEL.EXE 2004 EXCEL.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2004 wrote to memory of 1640 2004 EXCEL.EXE 28 PID 2004 wrote to memory of 1640 2004 EXCEL.EXE 28 PID 2004 wrote to memory of 1640 2004 EXCEL.EXE 28 PID 2004 wrote to memory of 1640 2004 EXCEL.EXE 28
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\Invoice-5959498320211004.xlsb1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic process call create 'mshta C:\ProgramData\vlEUL.rtf'2⤵
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
PID:1640
-
-
C:\Windows\system32\mshta.exemshta C:\ProgramData\vlEUL.rtf1⤵
- Process spawned unexpected child process
- Modifies Internet Explorer settings
PID:652