Resubmissions
09-12-2021 18:02
211209-wmyz3aeefp 1009-12-2021 13:52
211209-q6fpyadeck 1018-10-2021 09:36
211018-lkztgaecbm 1004-10-2021 17:53
211004-wgpjfaggb4 10Analysis
-
max time kernel
125s -
max time network
152s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
04-10-2021 17:53
Behavioral task
behavioral1
Sample
Invoice-5959498320211004.xlsb
Resource
win7v20210408
Behavioral task
behavioral2
Sample
Invoice-5959498320211004.xlsb
Resource
win10-en-20210920
General
-
Target
Invoice-5959498320211004.xlsb
-
Size
132KB
-
MD5
887bc475305003bdc34e671a2f3bd080
-
SHA1
7625f787be7479bf54addeff0ce7107cf0f59f23
-
SHA256
7e0b4b26bafd471703fac1db25b24936230aecad95732e66420184d717a111ee
-
SHA512
efb52e8c1fdf6e7cbc80b951220e25c78be0aad5c24b732696784b9b4d5d2c7a284df11fb0f524f64fa3f39a887069599c91f5233062d2aa8c01617104dd9ccd
Malware Config
Signatures
-
Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
wmic.exemshta.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 1676 2416 wmic.exe EXCEL.EXE Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3520 3348 mshta.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 2416 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 14 IoCs
Processes:
EXCEL.EXEpid process 2416 EXCEL.EXE 2416 EXCEL.EXE 2416 EXCEL.EXE 2416 EXCEL.EXE 2416 EXCEL.EXE 2416 EXCEL.EXE 2416 EXCEL.EXE 2416 EXCEL.EXE 2416 EXCEL.EXE 2416 EXCEL.EXE 2416 EXCEL.EXE 2416 EXCEL.EXE 2416 EXCEL.EXE 2416 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Invoice-5959498320211004.xlsb"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\Wbem\wmic.exewmic process call create 'mshta C:\ProgramData\vlEUL.rtf'2⤵
- Process spawned unexpected child process
-
C:\Windows\system32\mshta.exemshta C:\ProgramData\vlEUL.rtf1⤵
- Process spawned unexpected child process
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\vlEUL.rtfMD5
031c5dfeaa97b80bff2c5fd7999352ac
SHA10e89ec2d13631c157f7e577b7617099bc5e45cd5
SHA2566fbff6199b9a527c7a6c5ccec275a8ffda62f13b4ad29700075c2a8c217b11b6
SHA512766d84ace8e3d0683ab534c2c45bbedbd731121f0bf330edef51ae787350b8a6c81b6d0e103832c185677cdf778bd5567c877ff5e90e3e7ec2ed298c1f11529c
-
memory/1676-274-0x0000000000000000-mapping.dmp
-
memory/2416-118-0x00007FFDCB1B0000-0x00007FFDCB1C0000-memory.dmpFilesize
64KB
-
memory/2416-115-0x00007FF738FD0000-0x00007FF73C586000-memory.dmpFilesize
53.7MB
-
memory/2416-119-0x00007FFDCB1B0000-0x00007FFDCB1C0000-memory.dmpFilesize
64KB
-
memory/2416-122-0x00007FFDCB1B0000-0x00007FFDCB1C0000-memory.dmpFilesize
64KB
-
memory/2416-123-0x00007FFDEBD90000-0x00007FFDECE7E000-memory.dmpFilesize
16.9MB
-
memory/2416-124-0x00007FFDE9E90000-0x00007FFDEBD85000-memory.dmpFilesize
31.0MB
-
memory/2416-117-0x00007FFDCB1B0000-0x00007FFDCB1C0000-memory.dmpFilesize
64KB
-
memory/2416-116-0x00007FFDCB1B0000-0x00007FFDCB1C0000-memory.dmpFilesize
64KB
-
memory/2416-303-0x00007FFDCB1B0000-0x00007FFDCB1C0000-memory.dmpFilesize
64KB
-
memory/2416-306-0x00007FFDCB1B0000-0x00007FFDCB1C0000-memory.dmpFilesize
64KB
-
memory/2416-305-0x00007FFDCB1B0000-0x00007FFDCB1C0000-memory.dmpFilesize
64KB
-
memory/2416-304-0x00007FFDCB1B0000-0x00007FFDCB1C0000-memory.dmpFilesize
64KB