Analysis
-
max time kernel
133s -
max time network
161s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
13-10-2021 15:41
Behavioral task
behavioral1
Sample
Invoice-64145512_20211013.xlsb
Resource
win7v20210408
Behavioral task
behavioral2
Sample
Invoice-64145512_20211013.xlsb
Resource
win10v20210408
General
-
Target
Invoice-64145512_20211013.xlsb
-
Size
269KB
-
MD5
4e6d8b34d4441d66984a1b4fa51fe561
-
SHA1
a991079981a98f9cf3ceba151ce56d39fa522b5d
-
SHA256
6a5cd724baaebc19773830980de192cfa10e9d921469153399e656fbdd0ff972
-
SHA512
a934d862c117c7010b17473fe6c9d71824f43a95fe48e7bf93ce5505142a8dd29b5aacc9dc75bf7257571e494ae6b39e6ec399f9efa0e9dbb99722bcaa080804
Malware Config
Signatures
-
Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
wmic.exemshta.exedescription pid pid_target process target process Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1700 1804 wmic.exe EXCEL.EXE Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1300 368 mshta.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Processes:
EXCEL.EXEmshta.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1804 EXCEL.EXE -
Suspicious use of AdjustPrivilegeToken 40 IoCs
Processes:
wmic.exedescription pid process Token: SeIncreaseQuotaPrivilege 1700 wmic.exe Token: SeSecurityPrivilege 1700 wmic.exe Token: SeTakeOwnershipPrivilege 1700 wmic.exe Token: SeLoadDriverPrivilege 1700 wmic.exe Token: SeSystemProfilePrivilege 1700 wmic.exe Token: SeSystemtimePrivilege 1700 wmic.exe Token: SeProfSingleProcessPrivilege 1700 wmic.exe Token: SeIncBasePriorityPrivilege 1700 wmic.exe Token: SeCreatePagefilePrivilege 1700 wmic.exe Token: SeBackupPrivilege 1700 wmic.exe Token: SeRestorePrivilege 1700 wmic.exe Token: SeShutdownPrivilege 1700 wmic.exe Token: SeDebugPrivilege 1700 wmic.exe Token: SeSystemEnvironmentPrivilege 1700 wmic.exe Token: SeRemoteShutdownPrivilege 1700 wmic.exe Token: SeUndockPrivilege 1700 wmic.exe Token: SeManageVolumePrivilege 1700 wmic.exe Token: 33 1700 wmic.exe Token: 34 1700 wmic.exe Token: 35 1700 wmic.exe Token: SeIncreaseQuotaPrivilege 1700 wmic.exe Token: SeSecurityPrivilege 1700 wmic.exe Token: SeTakeOwnershipPrivilege 1700 wmic.exe Token: SeLoadDriverPrivilege 1700 wmic.exe Token: SeSystemProfilePrivilege 1700 wmic.exe Token: SeSystemtimePrivilege 1700 wmic.exe Token: SeProfSingleProcessPrivilege 1700 wmic.exe Token: SeIncBasePriorityPrivilege 1700 wmic.exe Token: SeCreatePagefilePrivilege 1700 wmic.exe Token: SeBackupPrivilege 1700 wmic.exe Token: SeRestorePrivilege 1700 wmic.exe Token: SeShutdownPrivilege 1700 wmic.exe Token: SeDebugPrivilege 1700 wmic.exe Token: SeSystemEnvironmentPrivilege 1700 wmic.exe Token: SeRemoteShutdownPrivilege 1700 wmic.exe Token: SeUndockPrivilege 1700 wmic.exe Token: SeManageVolumePrivilege 1700 wmic.exe Token: 33 1700 wmic.exe Token: 34 1700 wmic.exe Token: 35 1700 wmic.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
EXCEL.EXEpid process 1804 EXCEL.EXE 1804 EXCEL.EXE 1804 EXCEL.EXE 1804 EXCEL.EXE 1804 EXCEL.EXE 1804 EXCEL.EXE 1804 EXCEL.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
EXCEL.EXEdescription pid process target process PID 1804 wrote to memory of 1700 1804 EXCEL.EXE wmic.exe PID 1804 wrote to memory of 1700 1804 EXCEL.EXE wmic.exe PID 1804 wrote to memory of 1700 1804 EXCEL.EXE wmic.exe PID 1804 wrote to memory of 1700 1804 EXCEL.EXE wmic.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\Invoice-64145512_20211013.xlsb1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic process call create 'mshta C:\ProgramData\srwREKktqM.rtf'2⤵
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\mshta.exemshta C:\ProgramData\srwREKktqM.rtf1⤵
- Process spawned unexpected child process
- Modifies Internet Explorer settings
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\srwREKktqM.rtfMD5
8d1f493b8af4febc05b5dd0634f1d24c
SHA165e9bf9e203aab1b72c7878660044f42bf15c7f3
SHA25689b7347a7ce8567b3178767c556f799507aed73a96b06619d3e541c7107c3d23
SHA512b3af047052fa1c577295683d051bb6fa93c18b723941a48e3bd1daff39f033fe3e0bb4a470599c74fe52bf7c14cf096796f9c2bc79451ce4c521236e63061917
-
memory/1700-63-0x0000000000000000-mapping.dmp
-
memory/1804-60-0x000000002F481000-0x000000002F484000-memory.dmpFilesize
12KB
-
memory/1804-61-0x00000000716D1000-0x00000000716D3000-memory.dmpFilesize
8KB
-
memory/1804-62-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1804-64-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB