16821be1fa2994d90e1fae9dd30d760652a0fdcd402159f79d94902aa7f58ab2

General

Target

4a8d3e1f28dcddd8177e378b14b49dc0e23dad9772931f6616ce64ad17585fa7.xlsm
Size

240KB
MD5

f2bec56e09883a139201183f00f400a4
SHA1

6183a3935e2552484f53f74a6d340f8f451fe0b7
SHA256

4a8d3e1f28dcddd8177e378b14b49dc0e23dad9772931f6616ce64ad17585fa7
SHA512

d7b871c1cbe9e7726457897e54068c1e801b552292a960822a60aacbdb5c4aec2129bc698ef8ff42741b76be3f56ebfed234718b763226f1b6e2efd6fa6a6121

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 2 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

wmic.exemshta.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	5048	3392	wmic.exe	EXCEL.EXE
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3432	3100	mshta.exe

Blocklisted process makes network request 2 IoCs

Processes:

mshta.exe

flow pid process

40 3432 mshta.exe
42 3432 mshta.exe

flow	pid	process
40	3432	mshta.exe
42	3432	mshta.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

3392 EXCEL.EXE

Suspicious use of AdjustPrivilegeToken 42 IoCs

Processes:

wmic.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	5048	wmic.exe
Token: SeSecurityPrivilege	5048	wmic.exe
Token: SeTakeOwnershipPrivilege	5048	wmic.exe
Token: SeLoadDriverPrivilege	5048	wmic.exe
Token: SeSystemProfilePrivilege	5048	wmic.exe
Token: SeSystemtimePrivilege	5048	wmic.exe
Token: SeProfSingleProcessPrivilege	5048	wmic.exe
Token: SeIncBasePriorityPrivilege	5048	wmic.exe
Token: SeCreatePagefilePrivilege	5048	wmic.exe
Token: SeBackupPrivilege	5048	wmic.exe
Token: SeRestorePrivilege	5048	wmic.exe
Token: SeShutdownPrivilege	5048	wmic.exe
Token: SeDebugPrivilege	5048	wmic.exe
Token: SeSystemEnvironmentPrivilege	5048	wmic.exe
Token: SeRemoteShutdownPrivilege	5048	wmic.exe
Token: SeUndockPrivilege	5048	wmic.exe
Token: SeManageVolumePrivilege	5048	wmic.exe
Token: 33	5048	wmic.exe
Token: 34	5048	wmic.exe
Token: 35	5048	wmic.exe
Token: 36	5048	wmic.exe
Token: SeIncreaseQuotaPrivilege	5048	wmic.exe
Token: SeSecurityPrivilege	5048	wmic.exe
Token: SeTakeOwnershipPrivilege	5048	wmic.exe
Token: SeLoadDriverPrivilege	5048	wmic.exe
Token: SeSystemProfilePrivilege	5048	wmic.exe
Token: SeSystemtimePrivilege	5048	wmic.exe
Token: SeProfSingleProcessPrivilege	5048	wmic.exe
Token: SeIncBasePriorityPrivilege	5048	wmic.exe
Token: SeCreatePagefilePrivilege	5048	wmic.exe
Token: SeBackupPrivilege	5048	wmic.exe
Token: SeRestorePrivilege	5048	wmic.exe
Token: SeShutdownPrivilege	5048	wmic.exe
Token: SeDebugPrivilege	5048	wmic.exe
Token: SeSystemEnvironmentPrivilege	5048	wmic.exe
Token: SeRemoteShutdownPrivilege	5048	wmic.exe
Token: SeUndockPrivilege	5048	wmic.exe
Token: SeManageVolumePrivilege	5048	wmic.exe
Token: 33	5048	wmic.exe
Token: 34	5048	wmic.exe
Token: 35	5048	wmic.exe
Token: 36	5048	wmic.exe

Suspicious use of SetWindowsHookEx 16 IoCs

Processes:

EXCEL.EXE

pid	process
3392	EXCEL.EXE
3392	EXCEL.EXE
3392	EXCEL.EXE
3392	EXCEL.EXE
3392	EXCEL.EXE
3392	EXCEL.EXE
3392	EXCEL.EXE
3392	EXCEL.EXE
3392	EXCEL.EXE
3392	EXCEL.EXE
3392	EXCEL.EXE
3392	EXCEL.EXE
3392	EXCEL.EXE
3392	EXCEL.EXE
3392	EXCEL.EXE
3392	EXCEL.EXE

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

EXCEL.EXE

description pid process target process

PID 3392 wrote to memory of 5048 3392 EXCEL.EXE wmic.exe
PID 3392 wrote to memory of 5048 3392 EXCEL.EXE wmic.exe

description	pid	process	target process
PID 3392 wrote to memory of 5048	3392	EXCEL.EXE	wmic.exe
PID 3392 wrote to memory of 5048	3392	EXCEL.EXE	wmic.exe

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\4a8d3e1f28dcddd8177e378b14b49dc0e23dad9772931f6616ce64ad17585fa7.xlsm"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3392

C:\Windows\System32\Wbem\wmic.exe
wmic process call create 'mshta C:\ProgramData\IwfJmKwj.rtf'
2⤵
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
PID:5048

C:\Windows\system32\mshta.exe
mshta C:\ProgramData\IwfJmKwj.rtf
1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
PID:3432

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\IwfJmKwj.rtf
MD5
b4293c936f684d7ffdebda6b7ef9172b

SHA1
8165718390f44507406e358af2f0daadf326639e

SHA256
946dd16513ff67ff536d8153852de32ea1a07e87fd423eb2698a266dd22309dc

SHA512
3418f70ec448785f2970cd7a25a165ca27d9b889ff98a71d9fc95e3e0a9806f677c06c3316c4ab8ba3458531f3b360335ae360ea1445f1e8964de93db9bf7a04

Download Submit
memory/3392-115-0x00007FFAE6A50000-0x00007FFAE6A60000-memory.dmp

Filesize
64KB

Download
memory/3392-116-0x00007FFAE6A50000-0x00007FFAE6A60000-memory.dmp

Filesize
64KB

Download
memory/3392-117-0x00007FFAE6A50000-0x00007FFAE6A60000-memory.dmp

Filesize
64KB

Download
memory/3392-118-0x00007FFAE6A50000-0x00007FFAE6A60000-memory.dmp

Filesize
64KB

Download
memory/3392-119-0x00007FFAE6A50000-0x00007FFAE6A60000-memory.dmp

Filesize
64KB

Download
memory/3392-121-0x000001E4C0330000-0x000001E4C0332000-memory.dmp

Filesize
8KB

Download
memory/3392-120-0x000001E4C0330000-0x000001E4C0332000-memory.dmp

Filesize
8KB

Download
memory/3392-122-0x000001E4C0330000-0x000001E4C0332000-memory.dmp

Filesize
8KB

Download
memory/3392-128-0x00007FFAE3110000-0x00007FFAE3120000-memory.dmp

Filesize
64KB

Download
memory/3392-129-0x00007FFAE3110000-0x00007FFAE3120000-memory.dmp

Filesize
64KB

Download
memory/5048-259-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads